Overview

overview

10

Static

static

10

XWorm V5.4...ox.dll

windows7-x64

1

XWorm V5.4...ox.dll

windows10-2004-x64

1

XWorm V5.4/Fixer.bat

windows7-x64

1

XWorm V5.4/Fixer.bat

windows10-2004-x64

1

XWorm V5.4...re.dll

windows7-x64

1

XWorm V5.4...re.dll

windows10-2004-x64

1

XWorm V5.4...ms.dll

windows7-x64

1

XWorm V5.4...ms.dll

windows10-2004-x64

1

XWorm V5.4...I2.dll

windows7-x64

1

XWorm V5.4...I2.dll

windows10-2004-x64

1

XWorm V5.4...or.dll

windows7-x64

1

XWorm V5.4...or.dll

windows10-2004-x64

1

XWorm V5.4...nt.exe

windows7-x64

10

XWorm V5.4...nt.exe

windows10-2004-x64

10

XWorm V5.4/NAudio.dll

windows7-x64

1

XWorm V5.4/NAudio.dll

windows10-2004-x64

1

XWorm V5.4...on.dll

windows7-x64

1

XWorm V5.4...on.dll

windows10-2004-x64

1

XWorm V5.4...ws.dll

windows7-x64

1

XWorm V5.4...ws.dll

windows10-2004-x64

1

XWorm V5.4...at.dll

windows7-x64

1

XWorm V5.4...at.dll

windows10-2004-x64

1

XWorm V5.4...um.dll

windows7-x64

1

XWorm V5.4...um.dll

windows10-2004-x64

1

XWorm V5.4...rd.dll

windows7-x64

1

XWorm V5.4...rd.dll

windows10-2004-x64

1

XWorm V5.4...ss.dll

windows7-x64

1

XWorm V5.4...ss.dll

windows10-2004-x64

1

XWorm V5.4...er.dll

windows7-x64

1

XWorm V5.4...er.dll

windows10-2004-x64

1

XWorm V5.4...er.dll

windows7-x64

1

XWorm V5.4...er.dll

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    456ba538a6fa8751897a9a76aa88d69c0c01011af42a1a8f331204978424f456.rar

  • Size

    25.8MB

  • Sample

    240605-btgddaaa51

  • MD5

    bf9ac6288eae16a84359b0c4ea4ae847

  • SHA1

    8c95095b164e23e67d0d387b76807f08021a4245

  • SHA256

    456ba538a6fa8751897a9a76aa88d69c0c01011af42a1a8f331204978424f456

  • SHA512

    2bd97dcd75c478feaf4fc882b4a8d0fb27acbfe763e1f48d2740b37c993cbe920e92e9c83fe2cb75e248690687f8e950cf25a0d40d716feb6f6f52596116eda9

  • SSDEEP

    786432:UysUBxS7MybZCJxMJW18BQwEUuRtrftYodqS2:XBUIGQJ2g1orElrfhr2

Score
10/10
agentteslastormkittyxwormagilenetexecutionrattrojan

Malware Config

Extracted

Family

xworm

C2

127.0.0.1:7000

Attributes
  • install_file

    USB.exe

Targets

    • Target

      XWorm V5.4/FastColoredTextBox.dll

    • Size

      333KB

    • MD5

      b746707265772b362c0ba18d8d630061

    • SHA1

      4b185e5f68c00bef441adb737d0955646d4e569a

    • SHA256

      3701b19ccdac79b880b197756a972027e2ac609ebed36753bd989367ea4ef519

    • SHA512

      fd67f6c55940509e8060da53693cb5fbac574eb1e79d5bd8f9bbd43edbd05f68d5f73994798a0eed676d3e583e1c6cde608b54c03604b3818520fa18ad19aec8

    • SSDEEP

      6144:4FErOIif3RzSHh+20lXs1TzCeBcQeDbNlz7:eEeR52bmeh0n

    Score
    1/10
    behavioral1behavioral2

    • Target

      XWorm V5.4/Fixer.bat

    • Size

      122B

    • MD5

      2dabc46ce85aaff29f22cd74ec074f86

    • SHA1

      208ae3e48d67b94cc8be7bbfd9341d373fa8a730

    • SHA256

      a11703fd47d16020fa099a95bb4e46247d32cf8821dc1826e77a971cdd3c4c55

    • SHA512

      6a50b525bc5d8eb008b1b0d704f9942f72f1413e65751e3de83d2e16ef3cf02ef171b9da3fff0d2d92a81daac7f61b379fcf7a393f46e914435f6261965a53b3

    Score
    1/10
    behavioral3behavioral4

    • Target

      XWorm V5.4/GMap.NET.Core.dll

    • Size

      2.9MB

    • MD5

      819352ea9e832d24fc4cebb2757a462b

    • SHA1

      aba7e1b29bdcd0c5a307087b55c2ec0c7ca81f11

    • SHA256

      58c755fcfc65cddea561023d736e8991f0ad69da5e1378dea59e98c5db901b86

    • SHA512

      6a5b0e1553616ea29ec72c12072ae05bdd709468a173e8adbdfe391b072c001ecacb3dd879845f8d599c6152eca2530cdaa2c069b1f94294f778158eaaebe45a

    • SSDEEP

      49152:ot12Gb/hz7ZsK9qY5uyUW57VC4IB1+fXhQ1hyCzMw/22fSg7gjxhUE/nbTC0xemh:oLbteKb57W1+PhQ1HM1gmJ/SZmh

    Score
    1/10
    behavioral5behavioral6

    • Target

      XWorm V5.4/GMap.NET.WindowsForms.dll

    • Size

      147KB

    • MD5

      32a8742009ffdfd68b46fe8fd4794386

    • SHA1

      de18190d77ae094b03d357abfa4a465058cd54e3

    • SHA256

      741e1a8f05863856a25d101bd35bf97cba0b637f0c04ecb432c1d85a78ef1365

    • SHA512

      22418d5e887a6022abe8a7cbb0b6917a7478d468d211eecd03a95b8fb6452fc59db5178573e25d5d449968ead26bb0b2bfbfada7043c9a7a1796baca5235a82b

    • SSDEEP

      3072:k1GmgYqIY/0YSDBRGlDUqL63budipxj64m8HWYh3vHbFwMhLJSb+:lIO6rGloqL63qW62lJ

    Score
    1/10
    behavioral7behavioral8

    • Target

      XWorm V5.4/Guna.UI2.dll

    • Size

      1.9MB

    • MD5

      bcc0fe2b28edd2da651388f84599059b

    • SHA1

      44d7756708aafa08730ca9dbdc01091790940a4f

    • SHA256

      c6264665a882e73eb2262a74fea2c29b1921a9af33180126325fb67a851310ef

    • SHA512

      3bfc3d27c095dde988f779021d0479c8c1de80a404454813c6cae663e3fe63dc636bffa7de1094e18594c9d608fa7420a0651509544722f2a00288f0b7719cc8

    • SSDEEP

      24576:FIVZLRYIVQd9INo3FDbWX7SsOobBTEAjg+m+ZFNwaxwGoHQ/jzK+:+oWodbi9XFEAjg+m+ZFKaxw

    Score
    1/10
    behavioral10behavioral9

    • Target

      XWorm V5.4/IconExtractor.dll

    • Size

      10KB

    • MD5

      640d8ffa779c6dd5252a262e440c66c0

    • SHA1

      3252d8a70a18d5d4e0cc84791d587dd12a394c2a

    • SHA256

      440912d85d2f98bb4f508ab82847067c18e1e15be0d8ecdcff0cc19327527fc2

    • SHA512

      e12084f87bd46010aded22be30e902c5269a6f6bc88286d3bef17c71d070b17beada0fe9e691a2b2f76202b5f9265329f6444575f89aff8551c486eafe4d5f32

    • SSDEEP

      192:7f77J4cGYyfQknxLvIgyLY5xJeU5pPpZlEAs:HS2yINgyLYLJR5wl

    Score
    1/10
    behavioral11behavioral12

    • Target

      XWorm V5.4/Icons/XClient.exe

    • Size

      162KB

    • MD5

      f5f1d328ac2502686cd9a12b936daa75

    • SHA1

      d8a6c77022d413ddadda8036e41ba803b0664efd

    • SHA256

      2c177b01f77136c9f18b106a80d9a8cbe95e8232eeeac1df7061eb096cdd4d56

    • SHA512

      0c215316df54bd82a7997f3a841c83f72751efa1eadb6c7d07ca624a0a59c8217dd54e4a3de498b8d1b23cfcb99a4179163545bd2720cd3db1d6610f521dfb27

    • SSDEEP

      3072:TZ63JEGojxvVMnbO6uhzfrOxGkBz65/M6If+3Js+3JFkKeTnF:VUJVC9qbGRexBt25

    Score
    10/10
    xwormexecutionrattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Detects Windows executables referencing non-Windows User-Agents

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral13behavioral14

    • Target

      XWorm V5.4/NAudio.dll

    • Size

      502KB

    • MD5

      3b87d1363a45ce9368e9baec32c69466

    • SHA1

      70a9f4df01d17060ec17df9528fca7026cc42935

    • SHA256

      81b3f1dc3f1eac9762b8a292751a44b64b87d0d4c3982debfdd2621012186451

    • SHA512

      1f07d3b041763b4bc31f6bd7b181deb8d34ff66ec666193932ffc460371adbcd4451483a99009b9b0b71f3864ed5c15c6c3b3777fabeb76f9918c726c35eb7d7

    • SSDEEP

      6144:96/i10SZtfzWctj98vZcE0wmLlaIZs5eku2sX2hrjAzvgmXa6W9FwsT9idwktQZG:9yrSKMJR9aGs55T1X9Fwspi2tGpmS

    Score
    1/10
    behavioral15behavioral16

    • Target

      XWorm V5.4/Newtonsoft.Json.dll

    • Size

      695KB

    • MD5

      195ffb7167db3219b217c4fd439eedd6

    • SHA1

      1e76e6099570ede620b76ed47cf8d03a936d49f8

    • SHA256

      e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d

    • SHA512

      56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac

    • SSDEEP

      12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/

    Score
    1/10
    behavioral17behavioral18

    • Target

      XWorm V5.4/Plugins/ActiveWindows.dll

    • Size

      14KB

    • MD5

      2d74a69954a3820906f93ee046b40a59

    • SHA1

      d922a416bae6cb59089608f04d019d079cf23b8a

    • SHA256

      f530a53f1ce49843bbeb048f4096430570a8fd030463edce36737ccdf8b37176

    • SHA512

      1c24b77301b32167969c64da76f063c36e6378bcf4bb5b9d7643f52cabcf870785cbffb5741562317c3eb108e51e36b8323c577f1d24909e3c41026fcf69bfeb

    • SSDEEP

      192:gpsFElxHxzCXorWcsvaUJwfdBuo1I5+3gqT8AO1tW9Yr6IW1GXZ3+eh7EDmSLOb:3FELRzbrUw/AodT8ptsY7XZ3rED8b

    Score
    1/10
    behavioral19behavioral20

    • Target

      XWorm V5.4/Plugins/Chat.dll

    • Size

      18KB

    • MD5

      09b960e3a849587c5d89112995dfd241

    • SHA1

      2e5bd075a353d9fc5ae88792cb9fd1562ae860ac

    • SHA256

      dadf14dededd77b5535552072038ddcc6e53180479238035f69d8732dd975b9d

    • SHA512

      3b2afa3a1d2f37e7050f7534cbd47ebbc32333dd9da54187d7740b9e11ed61e2538761eea0c93d8fdfa9cf5d1f8d3e8fcb96bf76d2413c16b3940ed6f840ed9b

    • SSDEEP

      384:UUeRbCtl+SLFxdQ0C7sKmsfcrwTKvh6GIKoIYfWUWmf9:j4SpxaoKmJr0pIYfWXO

    Score
    1/10
    behavioral21behavioral22

    • Target

      XWorm V5.4/Plugins/Chromium.dll

    • Size

      32KB

    • MD5

      5364c989ee142f2a8eab2019ef924806

    • SHA1

      64d7e7f0da0a7b03a17206acc30f477986b25b08

    • SHA256

      9e6227794be4f0e2538c7fa8e36b59642bed88c6ff522733d775c4d121eb3d59

    • SHA512

      7e4a8ed65b9ff757c09657ed797a1360bdf719b2e12aa4b34d9caf445c376a20e6b9fefeb408c787c5ae2a5343e17696ab7847d62458a54b23e5b6a7aa6c55bc

    • SSDEEP

      768:zSyQlmUmBlEu9CgeiFTxL4k4Ir8rQURRgs93AWAjYLvdbKhJ+GHq3ZsK5frq:2yQltmBlPCgeiFTxL4k4Ir8rQURRgsKd

    Score
    1/10
    behavioral23behavioral24

    • Target

      XWorm V5.4/Plugins/Clipboard.dll

    • Size

      14KB

    • MD5

      a0fc91744b515085873af5734df02f69

    • SHA1

      e001d0618b50dbc4f1b73ee92d910547ded04c5b

    • SHA256

      f63b283387eca8efb8566caa35a258e56a1f0e918e1c6e66d4661e93de97ec30

    • SHA512

      4322e4df41ccbb1550343bb38ab7f5bd62e64426654caacbfe932071d4d5ea351fb0b7cb0b1804d70c21c757d2c277317c74984f4eede40928d37d9639beaaf4

    • SSDEEP

      192:F+e2PZKYnw/LzXsJ0zzBa70OFXgNTer149iY6IW1mX/60FzCCWk7RSLWMU:/2ZE3sJ0ha70USTe5Wi2X/6WjMU

    Score
    1/10
    behavioral25behavioral26

    • Target

      XWorm V5.4/Plugins/Cmstp-Bypass.dll

    • Size

      11KB

    • MD5

      cf15259e22b58a0dfd1156ab71cbd690

    • SHA1

      3614f4e469d28d6e65471099e2d45c8e28a7a49e

    • SHA256

      fa420fd3d1a5a2bb813ef8e6063480099f19091e8fa1b3389004c1ac559e806b

    • SHA512

      7302a424ed62ec20be85282ff545a4ca9e1aecfe20c45630b294c1ae72732465d8298537ee923d9e288ae0c48328e52ad8a1a503e549f8f8737fabe2e6e9ad38

    • SSDEEP

      192:KpXpS1QWlPkiqdE7FNNGGO9mWbpGkjgyaYcIW1vr/8TNU7aL7YiLsO08hdW5:Kp5IfL0mWbEkUyaYir/oNJL7KQ

    Score
    1/10
    behavioral27behavioral28

    • Target

      XWorm V5.4/Plugins/FileManager.dll

    • Size

      679KB

    • MD5

      63af8d0f4dd64bb8fd9c5e743cff3bb9

    • SHA1

      304a242f28018fa14c457ef965b84bc192a03760

    • SHA256

      eb2275b4ca61994eca25c9f6b90ac72ea267abab6d940c0a501cfd6695e3792d

    • SHA512

      1c3ee740949b387226d60ca68498e43a3f4d357c4c9724f443519f0fac85f1870d20a507d8c0b06327fc606d1ed2676d9c488bd8bb66428b888837fd0b922aa8

    • SSDEEP

      12288:P8b+nFeDTzZTmRwm0G/Ot69fN0RXwPgnOIMJhnWkhr48vR:UynF6mRwm0G/Ot6910NwPiOIMJhWk

    Score
    1/10
    behavioral29behavioral30

    • Target

      XWorm V5.4/Plugins/FileSeacher.dll

    • Size

      478KB

    • MD5

      63ce59d68b08598881688f4b6f87e597

    • SHA1

      036dd20d6aebe30056da2eff99c35eb6365bd55a

    • SHA256

      7ade8f9cc008d40848e9ce875c73e018a052a5e8cbe039efa2081a41bc3bcbd1

    • SHA512

      fb1b2ddd4ab370a678f51ef0c12e691f60e59ec1636ea709c1388569bb2d58da07a0ea9bdbccd5b492cd496b2fc081952ee5b5e1a6f13e8cbe65ee5eb737b653

    • SSDEEP

      6144:188L5lWTUVRTw/l97teGtSV41QJDsTDDh0Yhe6dwxLV/tuhgpn5AWRBI+WR:6zTUVRTw1lS4Ys50ie6Cf4gpZs

    Score
    1/10
    behavioral31behavioral32

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

agilenetagentteslaxwormstormkitty
Score
10/10

behavioral1

Score
1/10

behavioral2

Score
1/10

behavioral3

Score
1/10

behavioral4

Score
1/10

behavioral5

Score
1/10

behavioral6

Score
1/10

behavioral7

Score
1/10

behavioral8

Score
1/10

behavioral9

Score
1/10

behavioral10

Score
1/10

behavioral11

Score
1/10

behavioral12

Score
1/10

behavioral13

xwormexecutionrattrojan
Score
10/10

behavioral14

xwormexecutionrattrojan
Score
10/10

behavioral15

Score
1/10

behavioral16

Score
1/10

behavioral17

Score
1/10

behavioral18

Score
1/10

behavioral19

Score
1/10

behavioral20

Score
1/10

behavioral21

Score
1/10

behavioral22

Score
1/10

behavioral23

Score
1/10

behavioral24

Score
1/10

behavioral25

Score
1/10

behavioral26

Score
1/10

behavioral27

Score
1/10

behavioral28

Score
1/10

behavioral29

Score
1/10

behavioral30

Score
1/10

behavioral31

Score
1/10

behavioral32

Score
1/10