xworm

Resubmissions

02/05/2024, 02:55

240502-defjmshb4210

02/05/2024, 02:37

240502-c35m1agg8910

Sharing

Copy URL Twitter E-mail

General

Target
a ton of ya.zip
Size 1.2MB
Sample240502-c35m1agg89
SHA256 e1ea405efb08d4a7d254423fc5b700021eb653b1545d120c0f6cf4ff31c7f0ae
MD5 f4261ba39292a0f41c6e2bf8ea5e1a68
SHA1 f7a690eb8c983fbfb5e0f8b22dc746a9be2ae09b
SHA512 9b72eff4011fb718863caba4071816ec22fe9c67d0af2058e93b02c5d65a8cdfe05e641d8bf3f492899b9c63a2ab75474c0f7d04d87986832dff1782b3dc2845
SSDEEP 24576:u/x/K/n/Y/l/1/o/b/u/p/8/f/i/t/1/6/7/0/B/e/H/o/d/C/j/c/J/m/P/Q/lH:oJU/i9tSToh23MFtkzu54fSVsbWBAHaB
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

xworm

127.0.0.1:23638
209.25.140.1:5525:23638
bring-recorder.gl.at.ply.gg:23638
action-yesterday.gl.at.ply.gg:23638
147.185.221.19:23638
then-wheel.gl.at.ply.gg::23638
then-wheel.gl.at.ply.gg:23638
teen-modes.gl.at.ply.gg:23638

Attributes

Install_directory
%LocalAppData%
install_file
uwumonster.exe

Targets

- Target
  a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy (70).exe
- Size 63KB
- SHA256 ff43049677c57277f12a1d97f02af3029d7b75b5ad40303a28f1b0452997969d
- MD5 222c2d239f4c8a1d73c736c9cc712807
- SHA1 c3aa61bd6f8cc640bcfa74c40d9283c9c08c7b3c
- SHA512 1f2fea85e45e93916306c234b916d6b4b200dac9656e44f4555f825dd8677cb5e927bd5e7a74bf2fb2f6972a3e6e2d294a6104add162ba3d53a0e6cfedef6a02
- SSDEEP 1536:tJc/5q1qoR5PDdAZcIED4VuCkbFybjQ9f0jQRmONww+W:7c/iqoJekbFEQ9W+mONP+W
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

xworm persistence rat trojan
- Detect Xworm Payload
- Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral1
- Target
  a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy (75).exe
- Size 63KB
- SHA256 ff43049677c57277f12a1d97f02af3029d7b75b5ad40303a28f1b0452997969d
- MD5 222c2d239f4c8a1d73c736c9cc712807
- SHA1 c3aa61bd6f8cc640bcfa74c40d9283c9c08c7b3c
- SHA512 1f2fea85e45e93916306c234b916d6b4b200dac9656e44f4555f825dd8677cb5e927bd5e7a74bf2fb2f6972a3e6e2d294a6104add162ba3d53a0e6cfedef6a02
- SSDEEP 1536:tJc/5q1qoR5PDdAZcIED4VuCkbFybjQ9f0jQRmONww+W:7c/iqoJekbFEQ9W+mONP+W
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

xworm persistence rat trojan
- Detect Xworm Payload
- Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral2
- Target
  a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy (76).exe
- Size 63KB
- SHA256 ff43049677c57277f12a1d97f02af3029d7b75b5ad40303a28f1b0452997969d
- MD5 222c2d239f4c8a1d73c736c9cc712807
- SHA1 c3aa61bd6f8cc640bcfa74c40d9283c9c08c7b3c
- SHA512 1f2fea85e45e93916306c234b916d6b4b200dac9656e44f4555f825dd8677cb5e927bd5e7a74bf2fb2f6972a3e6e2d294a6104add162ba3d53a0e6cfedef6a02
- SSDEEP 1536:tJc/5q1qoR5PDdAZcIED4VuCkbFybjQ9f0jQRmONww+W:7c/iqoJekbFEQ9W+mONP+W
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

xworm persistence rat trojan
- Detect Xworm Payload
- Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral3
- Target
  a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy (77).exe
- Size 63KB
- SHA256 ff43049677c57277f12a1d97f02af3029d7b75b5ad40303a28f1b0452997969d
- MD5 222c2d239f4c8a1d73c736c9cc712807
- SHA1 c3aa61bd6f8cc640bcfa74c40d9283c9c08c7b3c
- SHA512 1f2fea85e45e93916306c234b916d6b4b200dac9656e44f4555f825dd8677cb5e927bd5e7a74bf2fb2f6972a3e6e2d294a6104add162ba3d53a0e6cfedef6a02
- SSDEEP 1536:tJc/5q1qoR5PDdAZcIED4VuCkbFybjQ9f0jQRmONww+W:7c/iqoJekbFEQ9W+mONP+W
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

xworm persistence rat trojan
- Detect Xworm Payload
- Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral4
- Target
  a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy (78).exe
- Size 63KB
- SHA256 ff43049677c57277f12a1d97f02af3029d7b75b5ad40303a28f1b0452997969d
- MD5 222c2d239f4c8a1d73c736c9cc712807
- SHA1 c3aa61bd6f8cc640bcfa74c40d9283c9c08c7b3c
- SHA512 1f2fea85e45e93916306c234b916d6b4b200dac9656e44f4555f825dd8677cb5e927bd5e7a74bf2fb2f6972a3e6e2d294a6104add162ba3d53a0e6cfedef6a02
- SSDEEP 1536:tJc/5q1qoR5PDdAZcIED4VuCkbFybjQ9f0jQRmONww+W:7c/iqoJekbFEQ9W+mONP+W
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

xworm persistence rat trojan
- Detect Xworm Payload
- Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral5
- Target
  a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy (79).exe
- Size 63KB
- SHA256 ff43049677c57277f12a1d97f02af3029d7b75b5ad40303a28f1b0452997969d
- MD5 222c2d239f4c8a1d73c736c9cc712807
- SHA1 c3aa61bd6f8cc640bcfa74c40d9283c9c08c7b3c
- SHA512 1f2fea85e45e93916306c234b916d6b4b200dac9656e44f4555f825dd8677cb5e927bd5e7a74bf2fb2f6972a3e6e2d294a6104add162ba3d53a0e6cfedef6a02
- SSDEEP 1536:tJc/5q1qoR5PDdAZcIED4VuCkbFybjQ9f0jQRmONww+W:7c/iqoJekbFEQ9W+mONP+W
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

xworm persistence rat trojan
- Detect Xworm Payload
- Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral6
- Target
  a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy (80).exe
- Size 63KB
- SHA256 ff43049677c57277f12a1d97f02af3029d7b75b5ad40303a28f1b0452997969d
- MD5 222c2d239f4c8a1d73c736c9cc712807
- SHA1 c3aa61bd6f8cc640bcfa74c40d9283c9c08c7b3c
- SHA512 1f2fea85e45e93916306c234b916d6b4b200dac9656e44f4555f825dd8677cb5e927bd5e7a74bf2fb2f6972a3e6e2d294a6104add162ba3d53a0e6cfedef6a02
- SSDEEP 1536:tJc/5q1qoR5PDdAZcIED4VuCkbFybjQ9f0jQRmONww+W:7c/iqoJekbFEQ9W+mONP+W
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

xworm persistence rat trojan
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Detect Xworm Payload
- Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral7
- Target
  a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy (81).exe
- Size 63KB
- SHA256 ff43049677c57277f12a1d97f02af3029d7b75b5ad40303a28f1b0452997969d
- MD5 222c2d239f4c8a1d73c736c9cc712807
- SHA1 c3aa61bd6f8cc640bcfa74c40d9283c9c08c7b3c
- SHA512 1f2fea85e45e93916306c234b916d6b4b200dac9656e44f4555f825dd8677cb5e927bd5e7a74bf2fb2f6972a3e6e2d294a6104add162ba3d53a0e6cfedef6a02
- SSDEEP 1536:tJc/5q1qoR5PDdAZcIED4VuCkbFybjQ9f0jQRmONww+W:7c/iqoJekbFEQ9W+mONP+W
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

xworm persistence rat trojan
- Detect Xworm Payload
- Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral8
- Target
  a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy (82).exe
- Size 63KB
- SHA256 ff43049677c57277f12a1d97f02af3029d7b75b5ad40303a28f1b0452997969d
- MD5 222c2d239f4c8a1d73c736c9cc712807
- SHA1 c3aa61bd6f8cc640bcfa74c40d9283c9c08c7b3c
- SHA512 1f2fea85e45e93916306c234b916d6b4b200dac9656e44f4555f825dd8677cb5e927bd5e7a74bf2fb2f6972a3e6e2d294a6104add162ba3d53a0e6cfedef6a02
- SSDEEP 1536:tJc/5q1qoR5PDdAZcIED4VuCkbFybjQ9f0jQRmONww+W:7c/iqoJekbFEQ9W+mONP+W
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

xworm persistence rat trojan
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Detect Xworm Payload
- Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral9
- Target
  a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy (83).exe
- Size 63KB
- SHA256 ff43049677c57277f12a1d97f02af3029d7b75b5ad40303a28f1b0452997969d
- MD5 222c2d239f4c8a1d73c736c9cc712807
- SHA1 c3aa61bd6f8cc640bcfa74c40d9283c9c08c7b3c
- SHA512 1f2fea85e45e93916306c234b916d6b4b200dac9656e44f4555f825dd8677cb5e927bd5e7a74bf2fb2f6972a3e6e2d294a6104add162ba3d53a0e6cfedef6a02
- SSDEEP 1536:tJc/5q1qoR5PDdAZcIED4VuCkbFybjQ9f0jQRmONww+W:7c/iqoJekbFEQ9W+mONP+W
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

xworm persistence rat trojan
- Detect Xworm Payload
- Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral10
- Target
  a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy (84).exe
- Size 63KB
- SHA256 ff43049677c57277f12a1d97f02af3029d7b75b5ad40303a28f1b0452997969d
- MD5 222c2d239f4c8a1d73c736c9cc712807
- SHA1 c3aa61bd6f8cc640bcfa74c40d9283c9c08c7b3c
- SHA512 1f2fea85e45e93916306c234b916d6b4b200dac9656e44f4555f825dd8677cb5e927bd5e7a74bf2fb2f6972a3e6e2d294a6104add162ba3d53a0e6cfedef6a02
- SSDEEP 1536:tJc/5q1qoR5PDdAZcIED4VuCkbFybjQ9f0jQRmONww+W:7c/iqoJekbFEQ9W+mONP+W
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

xworm persistence rat trojan
- Detect Xworm Payload
- Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral11
- Target
  a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy (85).exe
- Size 63KB
- SHA256 ff43049677c57277f12a1d97f02af3029d7b75b5ad40303a28f1b0452997969d
- MD5 222c2d239f4c8a1d73c736c9cc712807
- SHA1 c3aa61bd6f8cc640bcfa74c40d9283c9c08c7b3c
- SHA512 1f2fea85e45e93916306c234b916d6b4b200dac9656e44f4555f825dd8677cb5e927bd5e7a74bf2fb2f6972a3e6e2d294a6104add162ba3d53a0e6cfedef6a02
- SSDEEP 1536:tJc/5q1qoR5PDdAZcIED4VuCkbFybjQ9f0jQRmONww+W:7c/iqoJekbFEQ9W+mONP+W
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

xworm persistence rat trojan
- Detect Xworm Payload
- Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral12
- Target
  a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy (86).exe
- Size 63KB
- SHA256 ff43049677c57277f12a1d97f02af3029d7b75b5ad40303a28f1b0452997969d
- MD5 222c2d239f4c8a1d73c736c9cc712807
- SHA1 c3aa61bd6f8cc640bcfa74c40d9283c9c08c7b3c
- SHA512 1f2fea85e45e93916306c234b916d6b4b200dac9656e44f4555f825dd8677cb5e927bd5e7a74bf2fb2f6972a3e6e2d294a6104add162ba3d53a0e6cfedef6a02
- SSDEEP 1536:tJc/5q1qoR5PDdAZcIED4VuCkbFybjQ9f0jQRmONww+W:7c/iqoJekbFEQ9W+mONP+W
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

xworm persistence rat trojan
- Detect Xworm Payload
- Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral13
- Target
  a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy (87).exe
- Size 63KB
- SHA256 ff43049677c57277f12a1d97f02af3029d7b75b5ad40303a28f1b0452997969d
- MD5 222c2d239f4c8a1d73c736c9cc712807
- SHA1 c3aa61bd6f8cc640bcfa74c40d9283c9c08c7b3c
- SHA512 1f2fea85e45e93916306c234b916d6b4b200dac9656e44f4555f825dd8677cb5e927bd5e7a74bf2fb2f6972a3e6e2d294a6104add162ba3d53a0e6cfedef6a02
- SSDEEP 1536:tJc/5q1qoR5PDdAZcIED4VuCkbFybjQ9f0jQRmONww+W:7c/iqoJekbFEQ9W+mONP+W
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

xworm persistence rat trojan
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Detect Xworm Payload
- Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral14
- Target
  a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy (88).exe
- Size 63KB
- SHA256 ff43049677c57277f12a1d97f02af3029d7b75b5ad40303a28f1b0452997969d
- MD5 222c2d239f4c8a1d73c736c9cc712807
- SHA1 c3aa61bd6f8cc640bcfa74c40d9283c9c08c7b3c
- SHA512 1f2fea85e45e93916306c234b916d6b4b200dac9656e44f4555f825dd8677cb5e927bd5e7a74bf2fb2f6972a3e6e2d294a6104add162ba3d53a0e6cfedef6a02
- SSDEEP 1536:tJc/5q1qoR5PDdAZcIED4VuCkbFybjQ9f0jQRmONww+W:7c/iqoJekbFEQ9W+mONP+W
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

xworm persistence rat trojan
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Detect Xworm Payload
- Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral15
- Target
  a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy.exe
- Size 63KB
- SHA256 ff43049677c57277f12a1d97f02af3029d7b75b5ad40303a28f1b0452997969d
- MD5 222c2d239f4c8a1d73c736c9cc712807
- SHA1 c3aa61bd6f8cc640bcfa74c40d9283c9c08c7b3c
- SHA512 1f2fea85e45e93916306c234b916d6b4b200dac9656e44f4555f825dd8677cb5e927bd5e7a74bf2fb2f6972a3e6e2d294a6104add162ba3d53a0e6cfedef6a02
- SSDEEP 1536:tJc/5q1qoR5PDdAZcIED4VuCkbFybjQ9f0jQRmONww+W:7c/iqoJekbFEQ9W+mONP+W
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

xworm persistence rat trojan
- Detect Xworm Payload
- Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral16
- Target
  a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy.exe
- Size 63KB
- SHA256 ff43049677c57277f12a1d97f02af3029d7b75b5ad40303a28f1b0452997969d
- MD5 222c2d239f4c8a1d73c736c9cc712807
- SHA1 c3aa61bd6f8cc640bcfa74c40d9283c9c08c7b3c
- SHA512 1f2fea85e45e93916306c234b916d6b4b200dac9656e44f4555f825dd8677cb5e927bd5e7a74bf2fb2f6972a3e6e2d294a6104add162ba3d53a0e6cfedef6a02
- SSDEEP 1536:tJc/5q1qoR5PDdAZcIED4VuCkbFybjQ9f0jQRmONww+W:7c/iqoJekbFEQ9W+mONP+W
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

xworm persistence rat trojan
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Detect Xworm Payload
- Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral17
- Target
  a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy.exe
- Size 63KB
- SHA256 ff43049677c57277f12a1d97f02af3029d7b75b5ad40303a28f1b0452997969d
- MD5 222c2d239f4c8a1d73c736c9cc712807
- SHA1 c3aa61bd6f8cc640bcfa74c40d9283c9c08c7b3c
- SHA512 1f2fea85e45e93916306c234b916d6b4b200dac9656e44f4555f825dd8677cb5e927bd5e7a74bf2fb2f6972a3e6e2d294a6104add162ba3d53a0e6cfedef6a02
- SSDEEP 1536:tJc/5q1qoR5PDdAZcIED4VuCkbFybjQ9f0jQRmONww+W:7c/iqoJekbFEQ9W+mONP+W
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

xworm persistence rat trojan
- Detect Xworm Payload
- Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral18
- Target
  a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy.exe
- Size 63KB
- SHA256 ff43049677c57277f12a1d97f02af3029d7b75b5ad40303a28f1b0452997969d
- MD5 222c2d239f4c8a1d73c736c9cc712807
- SHA1 c3aa61bd6f8cc640bcfa74c40d9283c9c08c7b3c
- SHA512 1f2fea85e45e93916306c234b916d6b4b200dac9656e44f4555f825dd8677cb5e927bd5e7a74bf2fb2f6972a3e6e2d294a6104add162ba3d53a0e6cfedef6a02
- SSDEEP 1536:tJc/5q1qoR5PDdAZcIED4VuCkbFybjQ9f0jQRmONww+W:7c/iqoJekbFEQ9W+mONP+W
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

xworm persistence rat trojan
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Detect Xworm Payload
- Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral19
- Target
  a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy.exe
- Size 63KB
- SHA256 ff43049677c57277f12a1d97f02af3029d7b75b5ad40303a28f1b0452997969d
- MD5 222c2d239f4c8a1d73c736c9cc712807
- SHA1 c3aa61bd6f8cc640bcfa74c40d9283c9c08c7b3c
- SHA512 1f2fea85e45e93916306c234b916d6b4b200dac9656e44f4555f825dd8677cb5e927bd5e7a74bf2fb2f6972a3e6e2d294a6104add162ba3d53a0e6cfedef6a02
- SSDEEP 1536:tJc/5q1qoR5PDdAZcIED4VuCkbFybjQ9f0jQRmONww+W:7c/iqoJekbFEQ9W+mONP+W
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

xworm persistence rat trojan
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Detect Xworm Payload
- Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral20
- Target
  a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy.exe
- Size 63KB
- SHA256 ff43049677c57277f12a1d97f02af3029d7b75b5ad40303a28f1b0452997969d
- MD5 222c2d239f4c8a1d73c736c9cc712807
- SHA1 c3aa61bd6f8cc640bcfa74c40d9283c9c08c7b3c
- SHA512 1f2fea85e45e93916306c234b916d6b4b200dac9656e44f4555f825dd8677cb5e927bd5e7a74bf2fb2f6972a3e6e2d294a6104add162ba3d53a0e6cfedef6a02
- SSDEEP 1536:tJc/5q1qoR5PDdAZcIED4VuCkbFybjQ9f0jQRmONww+W:7c/iqoJekbFEQ9W+mONP+W
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

xworm persistence rat trojan
- Detect Xworm Payload
- Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral21
- Target
  a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy.exe
- Size 63KB
- SHA256 ff43049677c57277f12a1d97f02af3029d7b75b5ad40303a28f1b0452997969d
- MD5 222c2d239f4c8a1d73c736c9cc712807
- SHA1 c3aa61bd6f8cc640bcfa74c40d9283c9c08c7b3c
- SHA512 1f2fea85e45e93916306c234b916d6b4b200dac9656e44f4555f825dd8677cb5e927bd5e7a74bf2fb2f6972a3e6e2d294a6104add162ba3d53a0e6cfedef6a02
- SSDEEP 1536:tJc/5q1qoR5PDdAZcIED4VuCkbFybjQ9f0jQRmONww+W:7c/iqoJekbFEQ9W+mONP+W
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

xworm persistence rat trojan
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Detect Xworm Payload
- Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral22
- Target
  a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy.exe
- Size 63KB
- SHA256 ff43049677c57277f12a1d97f02af3029d7b75b5ad40303a28f1b0452997969d
- MD5 222c2d239f4c8a1d73c736c9cc712807
- SHA1 c3aa61bd6f8cc640bcfa74c40d9283c9c08c7b3c
- SHA512 1f2fea85e45e93916306c234b916d6b4b200dac9656e44f4555f825dd8677cb5e927bd5e7a74bf2fb2f6972a3e6e2d294a6104add162ba3d53a0e6cfedef6a02
- SSDEEP 1536:tJc/5q1qoR5PDdAZcIED4VuCkbFybjQ9f0jQRmONww+W:7c/iqoJekbFEQ9W+mONP+W
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

xworm persistence rat trojan
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Detect Xworm Payload
- Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral23
- Target
  a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy.exe
- Size 63KB
- SHA256 ff43049677c57277f12a1d97f02af3029d7b75b5ad40303a28f1b0452997969d
- MD5 222c2d239f4c8a1d73c736c9cc712807
- SHA1 c3aa61bd6f8cc640bcfa74c40d9283c9c08c7b3c
- SHA512 1f2fea85e45e93916306c234b916d6b4b200dac9656e44f4555f825dd8677cb5e927bd5e7a74bf2fb2f6972a3e6e2d294a6104add162ba3d53a0e6cfedef6a02
- SSDEEP 1536:tJc/5q1qoR5PDdAZcIED4VuCkbFybjQ9f0jQRmONww+W:7c/iqoJekbFEQ9W+mONP+W
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

xworm persistence rat trojan
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Detect Xworm Payload
- Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral24
- Target
  a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy.exe
- Size 63KB
- SHA256 ff43049677c57277f12a1d97f02af3029d7b75b5ad40303a28f1b0452997969d
- MD5 222c2d239f4c8a1d73c736c9cc712807
- SHA1 c3aa61bd6f8cc640bcfa74c40d9283c9c08c7b3c
- SHA512 1f2fea85e45e93916306c234b916d6b4b200dac9656e44f4555f825dd8677cb5e927bd5e7a74bf2fb2f6972a3e6e2d294a6104add162ba3d53a0e6cfedef6a02
- SSDEEP 1536:tJc/5q1qoR5PDdAZcIED4VuCkbFybjQ9f0jQRmONww+W:7c/iqoJekbFEQ9W+mONP+W
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

xworm persistence rat trojan
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Detect Xworm Payload
- Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral25
- Target
  a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy.exe
- Size 63KB
- SHA256 ff43049677c57277f12a1d97f02af3029d7b75b5ad40303a28f1b0452997969d
- MD5 222c2d239f4c8a1d73c736c9cc712807
- SHA1 c3aa61bd6f8cc640bcfa74c40d9283c9c08c7b3c
- SHA512 1f2fea85e45e93916306c234b916d6b4b200dac9656e44f4555f825dd8677cb5e927bd5e7a74bf2fb2f6972a3e6e2d294a6104add162ba3d53a0e6cfedef6a02
- SSDEEP 1536:tJc/5q1qoR5PDdAZcIED4VuCkbFybjQ9f0jQRmONww+W:7c/iqoJekbFEQ9W+mONP+W
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

xworm persistence rat trojan
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Detect Xworm Payload
- Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral26
- Target
  a ton of ya/ya - Copy - Copy - Copy - Copy - Copy.exe
- Size 63KB
- SHA256 ff43049677c57277f12a1d97f02af3029d7b75b5ad40303a28f1b0452997969d
- MD5 222c2d239f4c8a1d73c736c9cc712807
- SHA1 c3aa61bd6f8cc640bcfa74c40d9283c9c08c7b3c
- SHA512 1f2fea85e45e93916306c234b916d6b4b200dac9656e44f4555f825dd8677cb5e927bd5e7a74bf2fb2f6972a3e6e2d294a6104add162ba3d53a0e6cfedef6a02
- SSDEEP 1536:tJc/5q1qoR5PDdAZcIED4VuCkbFybjQ9f0jQRmONww+W:7c/iqoJekbFEQ9W+mONP+W
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

xworm persistence rat trojan
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Detect Xworm Payload
- Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral27
- Target
  a ton of ya/ya - Copy - Copy - Copy - Copy.exe
- Size 63KB
- SHA256 ff43049677c57277f12a1d97f02af3029d7b75b5ad40303a28f1b0452997969d
- MD5 222c2d239f4c8a1d73c736c9cc712807
- SHA1 c3aa61bd6f8cc640bcfa74c40d9283c9c08c7b3c
- SHA512 1f2fea85e45e93916306c234b916d6b4b200dac9656e44f4555f825dd8677cb5e927bd5e7a74bf2fb2f6972a3e6e2d294a6104add162ba3d53a0e6cfedef6a02
- SSDEEP 1536:tJc/5q1qoR5PDdAZcIED4VuCkbFybjQ9f0jQRmONww+W:7c/iqoJekbFEQ9W+mONP+W
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

xworm persistence rat trojan
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Detect Xworm Payload
- Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral28
- Target
  a ton of ya/ya - Copy - Copy - Copy.exe
- Size 63KB
- SHA256 ff43049677c57277f12a1d97f02af3029d7b75b5ad40303a28f1b0452997969d
- MD5 222c2d239f4c8a1d73c736c9cc712807
- SHA1 c3aa61bd6f8cc640bcfa74c40d9283c9c08c7b3c
- SHA512 1f2fea85e45e93916306c234b916d6b4b200dac9656e44f4555f825dd8677cb5e927bd5e7a74bf2fb2f6972a3e6e2d294a6104add162ba3d53a0e6cfedef6a02
- SSDEEP 1536:tJc/5q1qoR5PDdAZcIED4VuCkbFybjQ9f0jQRmONww+W:7c/iqoJekbFEQ9W+mONP+W
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

xworm persistence rat trojan
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Detect Xworm Payload
- Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral29
- Target
  a ton of ya/ya - Copy - Copy.exe
- Size 63KB
- SHA256 ff43049677c57277f12a1d97f02af3029d7b75b5ad40303a28f1b0452997969d
- MD5 222c2d239f4c8a1d73c736c9cc712807
- SHA1 c3aa61bd6f8cc640bcfa74c40d9283c9c08c7b3c
- SHA512 1f2fea85e45e93916306c234b916d6b4b200dac9656e44f4555f825dd8677cb5e927bd5e7a74bf2fb2f6972a3e6e2d294a6104add162ba3d53a0e6cfedef6a02
- SSDEEP 1536:tJc/5q1qoR5PDdAZcIED4VuCkbFybjQ9f0jQRmONww+W:7c/iqoJekbFEQ9W+mONP+W
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

xworm persistence rat trojan
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Detect Xworm Payload
- Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral30
- Target
  a ton of ya/ya - Copy.exe
- Size 63KB
- SHA256 ff43049677c57277f12a1d97f02af3029d7b75b5ad40303a28f1b0452997969d
- MD5 222c2d239f4c8a1d73c736c9cc712807
- SHA1 c3aa61bd6f8cc640bcfa74c40d9283c9c08c7b3c
- SHA512 1f2fea85e45e93916306c234b916d6b4b200dac9656e44f4555f825dd8677cb5e927bd5e7a74bf2fb2f6972a3e6e2d294a6104add162ba3d53a0e6cfedef6a02
- SSDEEP 1536:tJc/5q1qoR5PDdAZcIED4VuCkbFybjQ9f0jQRmONww+W:7c/iqoJekbFEQ9W+mONP+W
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

xworm persistence rat trojan
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Detect Xworm Payload
- Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral31
- Target
  a ton of ya/ya.exe
- Size 63KB
- SHA256 ff43049677c57277f12a1d97f02af3029d7b75b5ad40303a28f1b0452997969d
- MD5 222c2d239f4c8a1d73c736c9cc712807
- SHA1 c3aa61bd6f8cc640bcfa74c40d9283c9c08c7b3c
- SHA512 1f2fea85e45e93916306c234b916d6b4b200dac9656e44f4555f825dd8677cb5e927bd5e7a74bf2fb2f6972a3e6e2d294a6104add162ba3d53a0e6cfedef6a02
- SSDEEP 1536:tJc/5q1qoR5PDdAZcIED4VuCkbFybjQ9f0jQRmONww+W:7c/iqoJekbFEQ9W+mONP+W
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

xworm persistence rat trojan
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Detect Xworm Payload
- Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Extracted

Targets

Detect Xworm Payload

Drops startup file

Executes dropped EXE

Adds Run key to start application

Detect Xworm Payload

Xworm

Drops startup file

Executes dropped EXE

Adds Run key to start application

Detect Xworm Payload

Xworm

Drops startup file

Executes dropped EXE

Adds Run key to start application

Detect Xworm Payload

Xworm

Drops startup file

Executes dropped EXE

Adds Run key to start application

Detect Xworm Payload

Xworm

Drops startup file

Executes dropped EXE

Adds Run key to start application

Detect Xworm Payload

Xworm

Drops startup file

Executes dropped EXE

Adds Run key to start application

Contains code to disable Windows Defender

Detect Xworm Payload

Xworm

Drops startup file

Executes dropped EXE

Adds Run key to start application

Detect Xworm Payload

Xworm

Drops startup file

Executes dropped EXE

Adds Run key to start application

Contains code to disable Windows Defender

Detect Xworm Payload

Xworm

Drops startup file

Executes dropped EXE

Adds Run key to start application

Detect Xworm Payload

Xworm

Drops startup file

Executes dropped EXE

Adds Run key to start application

Detect Xworm Payload

Xworm

Drops startup file

Executes dropped EXE

Adds Run key to start application

Detect Xworm Payload

Xworm

Drops startup file

Executes dropped EXE

Adds Run key to start application

Detect Xworm Payload

Xworm

Drops startup file

Executes dropped EXE

Adds Run key to start application

Contains code to disable Windows Defender

Detect Xworm Payload

Xworm

Drops startup file

Executes dropped EXE

Adds Run key to start application

Contains code to disable Windows Defender