Overview

overview

10

Static

static

3

test32_protected.exe

windows7-x64

10

test32_protected.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    test32_protected.exe

  • Size

    700KB

  • Sample

    240806-b9yycszclf

  • MD5

    93be0670eb47b2f8e43b624a7549a036

  • SHA1

    7d15bf25454920d5fa7b13351a4f931fb41be19b

  • SHA256

    40f4d637bcf94657f7161730970e3f56d96791bbec175b39b9447f3d129e9d2d

  • SHA512

    0524848af6b4e7490a9fa87329d2c0b3a2bcbaa7c11831e0fb608737bf90debf6d9b274fde541a2f216cc7c00fcd62f27979ed7f8eb80e02b2c43ed571786ea5

  • SSDEEP

    12288:Hgeoo7YNQT1F85ZwKd89BcF6uVd10Lqvhl/ag7Zb4UPnIpVFBpLz:VpwQJyEvO6egTg7ZbehH

Score
10/10
xwormdiscoveryrattrojan

Malware Config

Extracted

Family

xworm

Attributes
  • Install_directory

    %AppData%

  • install_file

    XClient.exe

  • pastebin_url

    https://pastebin.com/raw/FdSMTxzR

Targets

    • Target

      test32_protected.exe

    • Size

      700KB

    • MD5

      93be0670eb47b2f8e43b624a7549a036

    • SHA1

      7d15bf25454920d5fa7b13351a4f931fb41be19b

    • SHA256

      40f4d637bcf94657f7161730970e3f56d96791bbec175b39b9447f3d129e9d2d

    • SHA512

      0524848af6b4e7490a9fa87329d2c0b3a2bcbaa7c11831e0fb608737bf90debf6d9b274fde541a2f216cc7c00fcd62f27979ed7f8eb80e02b2c43ed571786ea5

    • SSDEEP

      12288:Hgeoo7YNQT1F85ZwKd89BcF6uVd10Lqvhl/ag7Zb4UPnIpVFBpLz:VpwQJyEvO6egTg7ZbehH

    Score
    10/10
    xwormdiscoveryrattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks