Resubmissions

09/09/2024, 19:47

240909-yhlkaawgqp 3

16/08/2024, 15:24

240816-stchvswbkk 3

19/07/2024, 09:10

240719-k46wfswhja 1

19/07/2024, 09:10

240719-k41z7stalq 1

09/07/2024, 04:19

240709-exzwnswbnr 8

08/07/2024, 07:13

240708-h2an5azgkg 6

07/07/2024, 10:00

240707-l1l8ba1gqb 10

07/07/2024, 09:59

240707-l1e41a1gpc 1

06/07/2024, 07:41

240706-jjdhqstcpg 4

06/07/2024, 06:14

240706-gzq3na1blh 1

General

  • Target

    https://github.com

  • Sample

    240614-kbbjvasdjg

Malware Config

Extracted

Family

xworm

C2

care-hoping.gl.at.ply.gg:7782

Attributes
  • install_file

    USB.exe

  • telegram

    https://api.telegram.org/bot7105020896:AAEWcaqD_aJbQOVfc9bmrF_pW_Mfx50h6R4/sendMessage?chat_id=5691255400

Targets

    • Target

      https://github.com

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks