nworm | c8b054388ce391b1990f0288a16d2a836813c66543490da29a808f4b1cc2960d | Triage

Sharing

General

Target

58fbb320c0e8db05f0fb8d50ef3c1ab6_JaffaCakes118
Size

30KB
Sample

240729-xcp5vatfrn
MD5

58fbb320c0e8db05f0fb8d50ef3c1ab6
SHA1

c1e28234219d7a5ab9a6aea74dff513c39d97cab
SHA256

c8b054388ce391b1990f0288a16d2a836813c66543490da29a808f4b1cc2960d
SHA512

e73e28d1ca65e9325d9fb8db72d66ae60b5c91372808bf43548316f6482402d98d2059845afda8d7ec822c1b0ff8aa10f4ef215704e81feb21e28ab39dcad1e5
SSDEEP

768:8DPd+HOpsfpWLBZMbRWPkM1hrh1JB3O6WUQOKh1zOOexQoD:QobR6jZe61KhpraQm

Score

10^/10

nworm downloader worm

Malware Config

Extracted

Family

nworm

Version

v0.3.8

C2

jasongary2018-23544.portmap.io:23544

Mutex

d98c122d

Targets

- Target
  
  58fbb320c0e8db05f0fb8d50ef3c1ab6_JaffaCakes118
- Size
  
  30KB
- MD5
  
  58fbb320c0e8db05f0fb8d50ef3c1ab6
- SHA1
  
  c1e28234219d7a5ab9a6aea74dff513c39d97cab
- SHA256
  
  c8b054388ce391b1990f0288a16d2a836813c66543490da29a808f4b1cc2960d
- SHA512
  
  e73e28d1ca65e9325d9fb8db72d66ae60b5c91372808bf43548316f6482402d98d2059845afda8d7ec822c1b0ff8aa10f4ef215704e81feb21e28ab39dcad1e5
- SSDEEP
  
  768:8DPd+HOpsfpWLBZMbRWPkM1hrh1JB3O6WUQOKh1zOOexQoD:QobR6jZe61KhpraQm
Score

10^/10

nworm downloader worm
- NWorm
  A TrickBot module used to propagate to vulnerable domain controllers.
  worm downloader nworm
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

nwormdownloaderworm

behavioral2

nwormdownloaderworm