Overview

overview

10

Static

static

10

4d9fb14e15...5c.exe

windows7-x64

10

4d9fb14e15...5c.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4d9fb14e15d1613a7a5d70efbacb0f153729f02216116c3f7f117b033bd7655c.exe

  • Size

    36KB

  • Sample

    240522-r9be3afa56

  • MD5

    f55d89f82515bde23bb272f930cb9492

  • SHA1

    666d0f5a98f03292abf16cd2de599997c836926a

  • SHA256

    4d9fb14e15d1613a7a5d70efbacb0f153729f02216116c3f7f117b033bd7655c

  • SHA512

    a7a62daf90aae27207b77034e8a76d5b3f8aa05430bd8768d46be7f3843962ddc1ef154691dc0f26051605fbb36269e59f18c3c75fdf72222346188e7a6cf03b

  • SSDEEP

    384:/IFAz8mqQNv9qNx7kKka/sVxCTjMBVJYX7+u91X5Lj6WmyyNApPzuSvZ5mpkFyHZ:EApN1/qEMFj60y+hLFyT9CCOjhyPy2B

Score
10/10
xwormrattrojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

85.203.4.146:7000

Mutex

eItTbYBfBYihwkyW

Attributes
  • Install_directory

    %Userprofile%

  • install_file

    svchost.exe

aes.plain

Targets

    • Target

      4d9fb14e15d1613a7a5d70efbacb0f153729f02216116c3f7f117b033bd7655c.exe

    • Size

      36KB

    • MD5

      f55d89f82515bde23bb272f930cb9492

    • SHA1

      666d0f5a98f03292abf16cd2de599997c836926a

    • SHA256

      4d9fb14e15d1613a7a5d70efbacb0f153729f02216116c3f7f117b033bd7655c

    • SHA512

      a7a62daf90aae27207b77034e8a76d5b3f8aa05430bd8768d46be7f3843962ddc1ef154691dc0f26051605fbb36269e59f18c3c75fdf72222346188e7a6cf03b

    • SSDEEP

      384:/IFAz8mqQNv9qNx7kKka/sVxCTjMBVJYX7+u91X5Lj6WmyyNApPzuSvZ5mpkFyHZ:EApN1/qEMFj60y+hLFyT9CCOjhyPy2B

    Score
    10/10
    xwormrattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Drops startup file

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Tasks