Overview

overview

10

Static

static

10

XWorm V5.4...IP.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    XWorm V5.4 VIP By WantHacks.zip

  • Size

    26.7MB

  • Sample

    240720-1dnvysxbkb

  • MD5

    15b5324917b3adc9145f6127b9ee74df

  • SHA1

    1ad9c38ab5ffd1917c2c922d70e697010e6d24d8

  • SHA256

    d9810296cf669328bde635f3f0241412a7ac703d8132f90842d9e62c6a6f1d14

  • SHA512

    65a5fae03bd72c9b3662c8b0a2fb6162841a8434fc4374bccf117c40584e5f2285769e6c074c21f9337187198c28fb61cd6f00c50d63a4648bcc9bc17359fc2f

  • SSDEEP

    786432:MiSohRDBGmkYbgck9y7rySfrheqy7f95SAXTl7gDIiMSO:VZhRDBpCty7bsf7bXTl82

Score
10/10
agentteslastormkittyagilenetkeyloggerspywarestealertrojan

Malware Config

Targets

    • Target

      XWorm V5.4 VIP By WantHacks/XWorm V5.4 VIP.exe

    • Size

      13.8MB

    • MD5

      065a8d7fad2ad13b9f04de982294eb21

    • SHA1

      7ecf3a3b1a0fa25f701787d98bd42c6f39c2f8ce

    • SHA256

      3b2f28e621af3ea54abf28071e2f36143a30aa87a091f0ee3764c15b2dea4303

    • SHA512

      0b828b1e545326258f46b7b0c535bfde1fff5ab4bf43bc729803a96e81f4b29a5d0e5a00e59ae392d517051dba37abd5f3b4dacc348242475cfa9e8cbfa16e34

    • SSDEEP

      196608:msZttF81Wco24/vt8Kf67RQCTbJev4Z4t2WL8PSlsZA6G:mEtM1VR4cRZ0QZaL8qlsZVG

    Score
    10/10
    agentteslaagilenetkeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla payload

    • Loads dropped DLL

    • Obfuscated with Agile.Net obfuscator

      Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

      agilenet
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks