xworm | e069265534c2841bb1133c2ecf9d95cf73154737beaa3f8a763c7cf5037dc39a | Triage

Sharing

General

Target

upload.cmd
Size

80KB
Sample

240523-tvdmzsgh4t
MD5

9619f1ddef9f682e7e70d738513fbe95
SHA1

f60d6ccae771e30dd908ed35cd430321011d4e72
SHA256

e069265534c2841bb1133c2ecf9d95cf73154737beaa3f8a763c7cf5037dc39a
SHA512

371bb3fb57b2294c232e35e2b30c314ba879b3effb15cccca254df574fb3f97491d6ccc061e8569d21bfedda81055dcb993fa0c730f1021ac2ac4504e41b5c0a
SSDEEP

1536:5kqlZx2cA8O4bhwdKd7KZWcs+whqo8LR8O4mCrnxVIddBxPUJPNuYQti:5kqhtthgKde7Q8o8l3CrCrEPNuxi

Score

10^/10

xworm execution rat trojan

Malware Config

Extracted

Family

xworm

Version

3.1

C2

xgmn934.duckdns.org:8896

Mutex

2utLZrxcByvppTdF

Attributes

install_file
USB.exe

aes.plain

Targets

- Target
  
  upload.cmd
- Size
  
  80KB
- MD5
  
  9619f1ddef9f682e7e70d738513fbe95
- SHA1
  
  f60d6ccae771e30dd908ed35cd430321011d4e72
- SHA256
  
  e069265534c2841bb1133c2ecf9d95cf73154737beaa3f8a763c7cf5037dc39a
- SHA512
  
  371bb3fb57b2294c232e35e2b30c314ba879b3effb15cccca254df574fb3f97491d6ccc061e8569d21bfedda81055dcb993fa0c730f1021ac2ac4504e41b5c0a
- SSDEEP
  
  1536:5kqlZx2cA8O4bhwdKd7KZWcs+whqo8LR8O4mCrnxVIddBxPUJPNuYQti:5kqhtthgKde7Q8o8l3CrCrEPNuxi
Score

10^/10

execution xworm rat trojan
- Detect Xworm Payload
- Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

behavioral2

xwormexecutionrattrojan