Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

d4d4c8f121...51.exe

windows7-x64

10

d4d4c8f121...51.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a8f5eb653b660a24e0a0017c684c1b96.bin

  • Size

    380KB

  • Sample

    240501-b4khsada6s

  • MD5

    f4c2eb23f737ad3506dbaeae9991a292

  • SHA1

    ea9c8f1822d9c84caf07a776413263443ae601b8

  • SHA256

    af798e7c9e3ec896c9fc4891e128a5ef6035b027390320dd184d1dcef89ff470

  • SHA512

    5e81e8a18c42745431d62202a5c3aaeea8fb088b1f0d6071a75d00053101ae9096970bfab733d1d2eb9ffb41772ad7749f61e9de4e1afb5615d1eb49fa2e0634

  • SSDEEP

    6144:xpKBch4eYdzhADHVJ5lypP5mtzntISQrJqxIy8udNPYO5RLMeVmTuRoRHHvDB78y:xp4nwHVJ5gP8dtIpJA0iNPiZoif/UOG8

Score
10/10
xwormrattrojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

dav12221.duckdns.org:7000

Mutex

VnoSv30JNEHEbKof

Attributes
  • install_file

    USB.exe

aes.plain

Targets

    • Target

      d4d4c8f1217f38de76b3ba26865db8460987a0877ba70eb70f25fef6f5756c51.exe

    • Size

      755KB

    • MD5

      a8f5eb653b660a24e0a0017c684c1b96

    • SHA1

      4b75c2c8dba5f4198873a8ed0e0c4d2bf146d881

    • SHA256

      d4d4c8f1217f38de76b3ba26865db8460987a0877ba70eb70f25fef6f5756c51

    • SHA512

      0ff6026999fee1e6456a6557a82079a03622480edfd5aef9f7c1e3b03266a1e589fc4b3eb4568f3bec9f5f5f439f58aa313c8409241cbe4e1ffc1043c66a0b01

    • SSDEEP

      12288:HwglEe171o1+1k155scBRTWgwxPzDnkbIStV4bkX7cst2Ket3D6ohYc8A4isx:CnNKkbI0NjKRs

    Score
    10/10
    xwormrattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks