Overview

overview

10

Static

static

10

a ton of y... -.exe

windows7-x64

10

a ton of y... -.exe

windows7-x64

10

a ton of y... -.exe

windows7-x64

10

a ton of y... -.exe

windows7-x64

10

a ton of y... -.exe

windows7-x64

10

a ton of y... -.exe

windows7-x64

10

a ton of y... -.exe

windows7-x64

10

a ton of y... -.exe

windows7-x64

10

a ton of y... -.exe

windows7-x64

10

a ton of y... -.exe

windows7-x64

10

a ton of y... -.exe

windows7-x64

10

a ton of y... -.exe

windows7-x64

10

a ton of y... -.exe

windows7-x64

10

a ton of y... -.exe

windows7-x64

10

a ton of y... -.exe

windows7-x64

10

a ton of y... -.exe

windows7-x64

10

a ton of y...py.exe

windows7-x64

10

a ton of y...py.exe

windows7-x64

10

a ton of y...py.exe

windows7-x64

10

a ton of y...py.exe

windows7-x64

10

a ton of y...py.exe

windows7-x64

10

a ton of y...py.exe

windows7-x64

10

a ton of y...py.exe

windows7-x64

10

a ton of y...py.exe

windows7-x64

10

a ton of y...py.exe

windows7-x64

10

a ton of y...py.exe

windows7-x64

10

a ton of y...py.exe

windows7-x64

10

a ton of y...py.exe

windows7-x64

10

a ton of y...py.exe

windows7-x64

10

a ton of y...py.exe

windows7-x64

10

a ton of y...py.exe

windows7-x64

10

a ton of ya/ya.exe

windows7-x64

10

Resubmissions

02/05/2024, 02:55

240502-defjmshb4210

02/05/2024, 02:37

240502-c35m1agg8910

Sharing

Copy URL Twitter E-mail

General

  • Target
    a ton of ya.zip
  • Size 1.2MB
  • Sample240502-c35m1agg89
  • SHA256 e1ea405efb08d4a7d254423fc5b700021eb653b1545d120c0f6cf4ff31c7f0ae
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xwormpersistencerattrojan

Malware Config

Extracted

Family

  • xworm

C2

  • 127.0.0.1:23638

  • 209.25.140.1:5525:23638

  • bring-recorder.gl.at.ply.gg:23638

  • action-yesterday.gl.at.ply.gg:23638

  • 147.185.221.19:23638

  • then-wheel.gl.at.ply.gg::23638

  • then-wheel.gl.at.ply.gg:23638

  • teen-modes.gl.at.ply.gg:23638

Attributes
  • Install_directory

    %LocalAppData%

  • install_file

    uwumonster.exe

Targets

    • Target
      a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy (70).exe
    • Size 63KB
    • SHA256 ff43049677c57277f12a1d97f02af3029d7b75b5ad40303a28f1b0452997969d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xwormpersistencerattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral1
    • Target
      a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy (75).exe
    • Size 63KB
    • SHA256 ff43049677c57277f12a1d97f02af3029d7b75b5ad40303a28f1b0452997969d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xwormpersistencerattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral2
    • Target
      a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy (76).exe
    • Size 63KB
    • SHA256 ff43049677c57277f12a1d97f02af3029d7b75b5ad40303a28f1b0452997969d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xwormpersistencerattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral3
    • Target
      a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy (77).exe
    • Size 63KB
    • SHA256 ff43049677c57277f12a1d97f02af3029d7b75b5ad40303a28f1b0452997969d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xwormpersistencerattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral4
    • Target
      a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy (78).exe
    • Size 63KB
    • SHA256 ff43049677c57277f12a1d97f02af3029d7b75b5ad40303a28f1b0452997969d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xwormpersistencerattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral5
    • Target
      a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy (79).exe
    • Size 63KB
    • SHA256 ff43049677c57277f12a1d97f02af3029d7b75b5ad40303a28f1b0452997969d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xwormpersistencerattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral6
    • Target
      a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy (80).exe
    • Size 63KB
    • SHA256 ff43049677c57277f12a1d97f02af3029d7b75b5ad40303a28f1b0452997969d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xwormpersistencerattrojan

    • Contains code to disable Windows Defender

      A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral7
    • Target
      a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy (81).exe
    • Size 63KB
    • SHA256 ff43049677c57277f12a1d97f02af3029d7b75b5ad40303a28f1b0452997969d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xwormpersistencerattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral8
    • Target
      a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy (82).exe
    • Size 63KB
    • SHA256 ff43049677c57277f12a1d97f02af3029d7b75b5ad40303a28f1b0452997969d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xwormpersistencerattrojan

    • Contains code to disable Windows Defender

      A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral9
    • Target
      a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy (83).exe
    • Size 63KB
    • SHA256 ff43049677c57277f12a1d97f02af3029d7b75b5ad40303a28f1b0452997969d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xwormpersistencerattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral10
    • Target
      a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy (84).exe
    • Size 63KB
    • SHA256 ff43049677c57277f12a1d97f02af3029d7b75b5ad40303a28f1b0452997969d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xwormpersistencerattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral11
    • Target
      a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy (85).exe
    • Size 63KB
    • SHA256 ff43049677c57277f12a1d97f02af3029d7b75b5ad40303a28f1b0452997969d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xwormpersistencerattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral12
    • Target
      a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy (86).exe
    • Size 63KB
    • SHA256 ff43049677c57277f12a1d97f02af3029d7b75b5ad40303a28f1b0452997969d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xwormpersistencerattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral13
    • Target
      a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy (87).exe
    • Size 63KB
    • SHA256 ff43049677c57277f12a1d97f02af3029d7b75b5ad40303a28f1b0452997969d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xwormpersistencerattrojan

    • Contains code to disable Windows Defender

      A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral14
    • Target
      a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy (88).exe
    • Size 63KB
    • SHA256 ff43049677c57277f12a1d97f02af3029d7b75b5ad40303a28f1b0452997969d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xwormpersistencerattrojan

    • Contains code to disable Windows Defender

      A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral15
    • Target
      a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy.exe
    • Size 63KB
    • SHA256 ff43049677c57277f12a1d97f02af3029d7b75b5ad40303a28f1b0452997969d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xwormpersistencerattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral16
    • Target
      a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy.exe
    • Size 63KB
    • SHA256 ff43049677c57277f12a1d97f02af3029d7b75b5ad40303a28f1b0452997969d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xwormpersistencerattrojan

    • Contains code to disable Windows Defender

      A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral17
    • Target
      a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy.exe
    • Size 63KB
    • SHA256 ff43049677c57277f12a1d97f02af3029d7b75b5ad40303a28f1b0452997969d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xwormpersistencerattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral18
    • Target
      a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy.exe
    • Size 63KB
    • SHA256 ff43049677c57277f12a1d97f02af3029d7b75b5ad40303a28f1b0452997969d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xwormpersistencerattrojan

    • Contains code to disable Windows Defender

      A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral19
    • Target
      a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy.exe
    • Size 63KB
    • SHA256 ff43049677c57277f12a1d97f02af3029d7b75b5ad40303a28f1b0452997969d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xwormpersistencerattrojan

    • Contains code to disable Windows Defender

      A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral20
    • Target
      a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy.exe
    • Size 63KB
    • SHA256 ff43049677c57277f12a1d97f02af3029d7b75b5ad40303a28f1b0452997969d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xwormpersistencerattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral21
    • Target
      a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy.exe
    • Size 63KB
    • SHA256 ff43049677c57277f12a1d97f02af3029d7b75b5ad40303a28f1b0452997969d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xwormpersistencerattrojan

    • Contains code to disable Windows Defender

      A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral22
    • Target
      a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy.exe
    • Size 63KB
    • SHA256 ff43049677c57277f12a1d97f02af3029d7b75b5ad40303a28f1b0452997969d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xwormpersistencerattrojan

    • Contains code to disable Windows Defender

      A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral23
    • Target
      a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy.exe
    • Size 63KB
    • SHA256 ff43049677c57277f12a1d97f02af3029d7b75b5ad40303a28f1b0452997969d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xwormpersistencerattrojan

    • Contains code to disable Windows Defender

      A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral24
    • Target
      a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy.exe
    • Size 63KB
    • SHA256 ff43049677c57277f12a1d97f02af3029d7b75b5ad40303a28f1b0452997969d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xwormpersistencerattrojan

    • Contains code to disable Windows Defender

      A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral25
    • Target
      a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy.exe
    • Size 63KB
    • SHA256 ff43049677c57277f12a1d97f02af3029d7b75b5ad40303a28f1b0452997969d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xwormpersistencerattrojan

    • Contains code to disable Windows Defender

      A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral26
    • Target
      a ton of ya/ya - Copy - Copy - Copy - Copy - Copy.exe
    • Size 63KB
    • SHA256 ff43049677c57277f12a1d97f02af3029d7b75b5ad40303a28f1b0452997969d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xwormpersistencerattrojan

    • Contains code to disable Windows Defender

      A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral27
    • Target
      a ton of ya/ya - Copy - Copy - Copy - Copy.exe
    • Size 63KB
    • SHA256 ff43049677c57277f12a1d97f02af3029d7b75b5ad40303a28f1b0452997969d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xwormpersistencerattrojan

    • Contains code to disable Windows Defender

      A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral28
    • Target
      a ton of ya/ya - Copy - Copy - Copy.exe
    • Size 63KB
    • SHA256 ff43049677c57277f12a1d97f02af3029d7b75b5ad40303a28f1b0452997969d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xwormpersistencerattrojan

    • Contains code to disable Windows Defender

      A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral29
    • Target
      a ton of ya/ya - Copy - Copy.exe
    • Size 63KB
    • SHA256 ff43049677c57277f12a1d97f02af3029d7b75b5ad40303a28f1b0452997969d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xwormpersistencerattrojan

    • Contains code to disable Windows Defender

      A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral30
    • Target
      a ton of ya/ya - Copy.exe
    • Size 63KB
    • SHA256 ff43049677c57277f12a1d97f02af3029d7b75b5ad40303a28f1b0452997969d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xwormpersistencerattrojan

    • Contains code to disable Windows Defender

      A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral31
    • Target
      a ton of ya/ya.exe
    • Size 63KB
    • SHA256 ff43049677c57277f12a1d97f02af3029d7b75b5ad40303a28f1b0452997969d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xwormpersistencerattrojan

    • Contains code to disable Windows Defender

      A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral32

MITRE ATT&CK Enterprise v15

Tasks

static1

xworm
Score
10/10

behavioral1

xwormpersistencerattrojan
Score
10/10

behavioral2

xwormpersistencerattrojan
Score
10/10

behavioral3

xwormpersistencerattrojan
Score
10/10

behavioral4

xwormpersistencerattrojan
Score
10/10

behavioral5

xwormpersistencerattrojan
Score
10/10

behavioral6

xwormpersistencerattrojan
Score
10/10

behavioral7

xwormpersistencerattrojan
Score
10/10

behavioral8

xwormpersistencerattrojan
Score
10/10

behavioral9

xwormpersistencerattrojan
Score
10/10

behavioral10

xwormpersistencerattrojan
Score
10/10

behavioral11

xwormpersistencerattrojan
Score
10/10

behavioral12

xwormpersistencerattrojan
Score
10/10

behavioral13

xwormpersistencerattrojan
Score
10/10

behavioral14

xwormpersistencerattrojan
Score
10/10

behavioral15

xwormpersistencerattrojan
Score
10/10

behavioral16

xwormpersistencerattrojan
Score
10/10

behavioral17

xwormpersistencerattrojan
Score
10/10

behavioral18

xwormpersistencerattrojan
Score
10/10

behavioral19

xwormpersistencerattrojan
Score
10/10

behavioral20

xwormpersistencerattrojan
Score
10/10

behavioral21

xwormpersistencerattrojan
Score
10/10

behavioral22

xwormpersistencerattrojan
Score
10/10

behavioral23

xwormpersistencerattrojan
Score
10/10

behavioral24

xwormpersistencerattrojan
Score
10/10

behavioral25

xwormpersistencerattrojan
Score
10/10

behavioral26

xwormpersistencerattrojan
Score
10/10

behavioral27

xwormpersistencerattrojan
Score
10/10

behavioral28

xwormpersistencerattrojan
Score
10/10

behavioral29

xwormpersistencerattrojan
Score
10/10

behavioral30

xwormpersistencerattrojan
Score
10/10

behavioral31

xwormpersistencerattrojan
Score
10/10

behavioral32

xwormpersistencerattrojan
Score
10/10