General

  • Target

    Способ для робуксов.exe

  • Size

    155KB

  • Sample

    240531-x342pabb55

  • MD5

    2c4a39f9ac5bd64866032c0bd7faa9c5

  • SHA1

    ed6fdf71f0d0fedf29f6b78a207f5710426da78f

  • SHA256

    f38da3e39db37247e99bcbebfcd72a7ccc5811bbb1a7aef61ee310d15f7b1564

  • SHA512

    851127dd54647723eac9e61da7a85094b0b554fe2ef2b2885d89eb36807cbb7daf1ea2193d2f0b000131bcd4dc66ec6e2c16812e6d5a85ad987e35ae4ba0e05f

  • SSDEEP

    1536:3bRPzxY+ltJ7Fg9Bh8OMB4jls3WGkoe6Us89T8r9AtnertLFH:3bRPG+hFg9BWOM+a3v7EskT8rmtIhH

Score
10/10

Malware Config

Extracted

Family

xworm

Version

5.0

C2

glass-coffee.gl.at.ply.gg:5417

Mutex

NXMplQ2VmD02KTh5

Attributes
  • install_file

    USB.exe

  • telegram

    https://api.telegram.org/bot7244696222:AAHqbV7Klrbtt5G5MocnpyydNFGt1mksjWg/sendMessage?chat_id=5854542114

aes.plain

Targets

    • Target

      Способ для робуксов.exe

    • Size

      155KB

    • MD5

      2c4a39f9ac5bd64866032c0bd7faa9c5

    • SHA1

      ed6fdf71f0d0fedf29f6b78a207f5710426da78f

    • SHA256

      f38da3e39db37247e99bcbebfcd72a7ccc5811bbb1a7aef61ee310d15f7b1564

    • SHA512

      851127dd54647723eac9e61da7a85094b0b554fe2ef2b2885d89eb36807cbb7daf1ea2193d2f0b000131bcd4dc66ec6e2c16812e6d5a85ad987e35ae4ba0e05f

    • SSDEEP

      1536:3bRPzxY+ltJ7Fg9Bh8OMB4jls3WGkoe6Us89T8r9AtnertLFH:3bRPG+hFg9BWOM+a3v7EskT8rmtIhH

    Score
    10/10
    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v15

Tasks