xworm | 2511385dc0af9f0a266b12fd99890f2d3dd2707a2053a5ba37e7aab81de00ea2 | Triage

Sharing

General

Target

XClient.exe
Size

56KB
Sample

240615-bry6eaxhkj
MD5

2c6e7b178d60acf171fb53602265c655
SHA1

20670f2ac41697b9839214036558504b7dac82e0
SHA256

2511385dc0af9f0a266b12fd99890f2d3dd2707a2053a5ba37e7aab81de00ea2
SHA512

e6c7106621e1bfc178e282140477c02dc437ad1e0caaf6cd2235337e9050bbcab38d9940531427a30ddda5e1850af2e0da9cf6333d476a8759ac9caf6734710d
SSDEEP

768:LKeBzfpaNfm7E9uU/tmTfDl1Rzbg+p97tbujwflYpGeOlvxh7+6xN:LKe6N9/M31zbg+p9Z7fKjOf4W

Score

10^/10

xworm persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

3.0

C2

updates-planners.gl.at.ply.gg:4040

Attributes

Install_directory
%AppData%
install_file
www.MpCmdRun.exe

Targets

- Target
  
  XClient.exe
- Size
  
  56KB
- MD5
  
  2c6e7b178d60acf171fb53602265c655
- SHA1
  
  20670f2ac41697b9839214036558504b7dac82e0
- SHA256
  
  2511385dc0af9f0a266b12fd99890f2d3dd2707a2053a5ba37e7aab81de00ea2
- SHA512
  
  e6c7106621e1bfc178e282140477c02dc437ad1e0caaf6cd2235337e9050bbcab38d9940531427a30ddda5e1850af2e0da9cf6333d476a8759ac9caf6734710d
- SSDEEP
  
  768:LKeBzfpaNfm7E9uU/tmTfDl1Rzbg+p97tbujwflYpGeOlvxh7+6xN:LKe6N9/M31zbg+p9Z7fKjOf4W
Score

10^/10

xworm persistence rat trojan
- Detect Xworm Payload
- Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Drops startup file
- Adds Run key to start application
  persistence
behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

xwormpersistencerattrojan