Overview

overview

10

Static

static

10

XWorm V5.3....3.exe

windows7-x64

10

XWorm V5.3....3.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    XWorm V5.3 Optimized Bin.zip

  • Size

    31.3MB

  • Sample

    240613-3xxnbazenn

  • MD5

    c3b0b168a04422f2980f7c01fbb2159b

  • SHA1

    c563b73c5a691626f373aa342af1f8cf3c8164f5

  • SHA256

    952328d0818943a9718cdb2965f514f247fd3035fb42e4ef4bc767c2842a38b7

  • SHA512

    b55834a59ab737cd5daaf7e0e856ff1f05cdeb035e8865caba577fad339d4cd8959bf9a2b49a50d8708ff0e3a589ad9e1d326fad3188e5899d6ed9a49123aaa4

  • SSDEEP

    786432:asWX23QgeyHwlbWz2xbwppSSK/oZa7zFvXCif1+uuJdHk0X/faQDl44Dx:8X23QghQcq9kSSKVvFSZZvfNDLx

Score
10/10
agentteslastormkittyagilenetkeyloggerspywarestealertrojan

Malware Config

Targets

    • Target

      XWorm V5.3 Optimized Bin/XWorm V5.3.exe

    • Size

      13.8MB

    • MD5

      897201dc6254281404ab74aa27790a71

    • SHA1

      9409ddf7e72b7869f4d689c88f9bbc1bc241a56e

    • SHA256

      f41828bd13a3a85fdf7a1d688b21ce33d2015c3c5f46b4d92ab6ea8ea019e03a

    • SHA512

      2673cd7b927ffc22f3a4b4fbfcb1b4f576c416d67168e486e6d79fdd132129c9e244e36d7b7883a4a1ed51e993cc4384bf24f2fa3129584f2bd43fd16042de20

    • SSDEEP

      98304:rtktdI2TeowYNva0P6olJ93ipte/Giw56/gpeejzhAAsnQqHKrzzIRwG4saY6c2n:rGt3JwVFcV/Gp7jiwzYwENy3W

    Score
    10/10
    agentteslaagilenetkeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla payload

    • Loads dropped DLL

    • Obfuscated with Agile.Net obfuscator

      Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

      agilenet
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks