Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    VicTweaks.exe

  • Size

    153KB

  • Sample

    240712-pvdkrstelr

  • MD5

    f77f28c05650e81f23e8ca6659607b11

  • SHA1

    eb7ece2f3515c2b402be5bc79967318ed4cdcb09

  • SHA256

    e6f83dc04194dcd171ec918e9545b5f1ef71276b17ac03946e66e640eb37d9e6

  • SHA512

    f0b47486f95b53e72605aeedd9d583408dffbb784cb618aaa3eec2726d1300488d186ba21f11403b91c2fa382bfb836fb7e286921b31e0a57425d8b9eeb59713

  • SSDEEP

    3072:xrBuw2j46bqwXi/OiS71HBz65/M6If+3Js+3JFkKeTne:xebVnZHxBt25

Score
10/10

Malware Config

Extracted

Family

xworm

C2

127.0.0.1:7000

12.0.0.0.1:7000

Attributes
  • Install_directory

    %ProgramData%

  • install_file

    VicToolsRuntime.exe

Targets

    • Target

      VicTweaks.exe

    • Size

      153KB

    • MD5

      f77f28c05650e81f23e8ca6659607b11

    • SHA1

      eb7ece2f3515c2b402be5bc79967318ed4cdcb09

    • SHA256

      e6f83dc04194dcd171ec918e9545b5f1ef71276b17ac03946e66e640eb37d9e6

    • SHA512

      f0b47486f95b53e72605aeedd9d583408dffbb784cb618aaa3eec2726d1300488d186ba21f11403b91c2fa382bfb836fb7e286921b31e0a57425d8b9eeb59713

    • SSDEEP

      3072:xrBuw2j46bqwXi/OiS71HBz65/M6If+3Js+3JFkKeTne:xebVnZHxBt25

    Score
    10/10
    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

    • Drops startup file

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v15

Tasks