Overview

overview

10

Static

static

10

XWorm V5.2.exe

windows7-x64

10

XWorm V5.2.exe

windows10-2004-x64

10

XWormLoade...32.exe

windows7-x64

1

XWormLoade...32.exe

windows10-2004-x64

10

XWormLoade...64.exe

windows7-x64

1

XWormLoade...64.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    XWorm V5.2.gdsiuhsdfgjkhdfsgfghjidsgdfsuih
  • Size 30.2MB
  • Sample240717-l5aebayfpe
  • SHA256 781466da68612656e87f1c5027d3c6044ad16b5e73aa3f733e7778c053c6b68e
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
agentteslastormkittyxwormagilenetkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

  • xworm

Version

  • 5.0

C2

  • copyright-minority.gl.at.ply.gg:4568

Mutex

  • FyjXt4o9DH3Aahsl

Attributes
  • install_file

    USB.exe

aes.plain

Targets

    • Target
      XWorm V5.2.exe
    • Size 12.2MB
    • SHA256 7fc9c7002b65bc1b33f72e019ed1e82008cc7b8e5b8eaf73fc41a3e6a246980e
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    agentteslaagilenetkeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla payload

    • Loads dropped DLL

    • Obfuscated with Agile.Net obfuscator

      Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

      agilenet
    behavioral1behavioral2
    • Target
      XWormLoader 5.2 x32.exe
    • Size 109KB
    • SHA256 2d74eb709aea89a181cf8dfcc7e551978889f0d875401a2f1140487407bf18ae
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    agentteslaagilenetkeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla payload

    • Loads dropped DLL

    • Obfuscated with Agile.Net obfuscator

      Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

      agilenet
    behavioral3behavioral4
    • Target
      XWormLoader 5.2 x64.exe
    • Size 109KB
    • SHA256 b461c985b53de4f6921d83925b3c2a62de3bbc5b8f9c02eecd27926f0197fae2
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    agentteslaagilenetkeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla payload

    • Loads dropped DLL

    • Obfuscated with Agile.Net obfuscator

      Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

      agilenet
    behavioral5behavioral6

MITRE ATT&CK Enterprise v15

Tasks