Overview

overview

10

Static

static

3

CraxsRat v7.4‌.exe

windows10-1703-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    CraxsRat v7.4‌.exe

  • Size

    52.9MB

  • Sample

    240512-v2gtnabb73

  • MD5

    b01bdd32529dc91827999dfdff59bf98

  • SHA1

    f642eb6711dbc13a009f3db0a83a931b3f74a301

  • SHA256

    25dadd7bd62f767a0aebcd18f3faaf22fcfeb3cff004576fe9c71d412005da0a

  • SHA512

    5e869ba2a8f332615d666c68c6c641734cb362830972ff4d87f89a67d1fa722e2c3e2aa40f9ac95b9f2ce5f4477d4b2fa33980e77e729ba96f0ac6bcebe502ad

  • SSDEEP

    1572864:xkSNSC0I9kSSUwkO9PEWztlGrvcjiqz+V:lN9kxZHvPGQvz+V

Score
10/10
xwormexecutionrattrojan

Malware Config

Extracted

Family

xworm

C2

us1.localto.net:38447

Attributes
  • Install_directory

    %AppData%

  • install_file

    svchost.exe

  • telegram

    https://api.telegram.org/bot7023899363:AAFEzgbfWzhyE32Lf95TKSRYEYXMd4AfMyk/sendMessage?chat_id=6354844663

Targets

    • Target

      CraxsRat v7.4‌.exe

    • Size

      52.9MB

    • MD5

      b01bdd32529dc91827999dfdff59bf98

    • SHA1

      f642eb6711dbc13a009f3db0a83a931b3f74a301

    • SHA256

      25dadd7bd62f767a0aebcd18f3faaf22fcfeb3cff004576fe9c71d412005da0a

    • SHA512

      5e869ba2a8f332615d666c68c6c641734cb362830972ff4d87f89a67d1fa722e2c3e2aa40f9ac95b9f2ce5f4477d4b2fa33980e77e729ba96f0ac6bcebe502ad

    • SSDEEP

      1572864:xkSNSC0I9kSSUwkO9PEWztlGrvcjiqz+V:lN9kxZHvPGQvz+V

    Score
    10/10
    xwormexecutionrattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Drops startup file

    • Executes dropped EXE

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks