Overview

overview

10

Static

static

10

Onioncrack.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Onioncrack.exe

  • Size

    206KB

  • Sample

    240602-tj8c8agb8z

  • MD5

    166cd568396c15d96cc171fd9662c430

  • SHA1

    ae4c4d7f9d7d823fead036878bc832e84ce8cf8e

  • SHA256

    ef1eeafff3219798e7810a3653a680104d82e731d4e2cc9e10c2c0425a6afcd8

  • SHA512

    aba1aced15e826b970b463e551882c13d5c22f6d848c527e577d1724a48ef0a8cd46969e74a4ca7826ddac605f1a1383fa900db8309a847107f312d347c62905

  • SSDEEP

    3072:IBkaQl7LFc90cOMn8SKfbzxcwg7es6/Vsb8VKTup49oJMfF/H9N3Ky9NzLna:IYdc9LUhcX7elbKTuq9bfF/H9d9n

Score
10/10
xwormpersistencerattrojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

glass-coffee.gl.at.ply.gg:5417

Mutex

uvV9IoGdqsyWtzwq

Attributes
  • Install_directory

    %AppData%

  • install_file

    XClient.exe

  • telegram

    https://api.telegram.org/bot7244696222:AAHqbV7Klrbtt5G5MocnpyydNFGt1mksjWg/sendMessage?chat_id=5854542114

aes.plain

Targets

    • Target

      Onioncrack.exe

    • Size

      206KB

    • MD5

      166cd568396c15d96cc171fd9662c430

    • SHA1

      ae4c4d7f9d7d823fead036878bc832e84ce8cf8e

    • SHA256

      ef1eeafff3219798e7810a3653a680104d82e731d4e2cc9e10c2c0425a6afcd8

    • SHA512

      aba1aced15e826b970b463e551882c13d5c22f6d848c527e577d1724a48ef0a8cd46969e74a4ca7826ddac605f1a1383fa900db8309a847107f312d347c62905

    • SSDEEP

      3072:IBkaQl7LFc90cOMn8SKfbzxcwg7es6/Vsb8VKTup49oJMfF/H9N3Ky9NzLna:IYdc9LUhcX7elbKTuq9bfF/H9d9n

    Score
    10/10
    xwormpersistencerattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Drops startup file

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks