Overview

overview

10

Static

static

10

FenixScirpt.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    FenixScirpt.exe

  • Size

    83KB

  • Sample

    240511-pa1jssab75

  • MD5

    27594df69c2b41cf91a15128fb819f8e

  • SHA1

    173d09d120d7ffef277b9878f9efd17f8db617a1

  • SHA256

    ad359ca488b72f7a004f4562a34e8489f788e8b25ff588e44d9a8425d70a7964

  • SHA512

    9c24c74c0f277241eb2d1c25e7012f2df4689b620dab6dc9822970debdf698c42b9462ab6ccf649384e4570cbaa728537dc2b6e48d673ec37c47a49ce96290a5

  • SSDEEP

    1536:wDQahmS6E3HyrUfBSeLt9bBAMmuAYPzOq+Jhb0OJVH:eQo2EXyofnt9bB9muVPzOq+JhrnH

Score
10/10
modiloaderxwormpersistencerattrojanupx

Malware Config

Extracted

Family

xworm

Attributes
  • Install_directory

    %AppData%

  • install_file

    USB.exe

  • pastebin_url

    https://pastebin.com/raw/cVQrB6DR

Targets

    • Target

      FenixScirpt.exe

    • Size

      83KB

    • MD5

      27594df69c2b41cf91a15128fb819f8e

    • SHA1

      173d09d120d7ffef277b9878f9efd17f8db617a1

    • SHA256

      ad359ca488b72f7a004f4562a34e8489f788e8b25ff588e44d9a8425d70a7964

    • SHA512

      9c24c74c0f277241eb2d1c25e7012f2df4689b620dab6dc9822970debdf698c42b9462ab6ccf649384e4570cbaa728537dc2b6e48d673ec37c47a49ce96290a5

    • SSDEEP

      1536:wDQahmS6E3HyrUfBSeLt9bBAMmuAYPzOq+Jhb0OJVH:eQo2EXyofnt9bB9muVPzOq+JhrnH

    Score
    10/10
    modiloaderxwormpersistencerattrojanupx

    • Detect Xworm Payload

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • ModiLoader Second Stage

    • Modifies Installed Components in the registry

      persistence

    • Drops startup file

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks