General

  • Target
    Xworm-Crack-main.zip
  • Size 17.2MB
  • Sample240811-bf7y6ssamd
  • SHA256 9dd1682f5e8414c278f9d99866fa955a814c136b7f13678a8187ca007731a942
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • xworm

C2
  • 127.0.0.1:59769

  • usr-contemporary.gl.at.ply.gg:59769

Attributes
  • Install_directory

    %Userprofile%

Targets

    • Target
      Xwrom/FastColoredTextBox.dll
    • Size 333KB
    • SHA256 3701b19ccdac79b880b197756a972027e2ac609ebed36753bd989367ea4ef519
    • MD5 SHA1 SHA512 SSDEEP
    Score
    4/10
    • Target
      Xwrom/Fixer.bat
    • Size 122B
    • SHA256 a11703fd47d16020fa099a95bb4e46247d32cf8821dc1826e77a971cdd3c4c55
    • MD5 SHA1 SHA512
    Score
    1/10
    • Target
      Xwrom/GMap.NET.Core.dll
    • Size 2.9MB
    • SHA256 58c755fcfc65cddea561023d736e8991f0ad69da5e1378dea59e98c5db901b86
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      Xwrom/GMap.NET.WindowsForms.dll
    • Size 147KB
    • SHA256 741e1a8f05863856a25d101bd35bf97cba0b637f0c04ecb432c1d85a78ef1365
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      Xwrom/Guna.UI2.dll
    • Size 1.9MB
    • SHA256 c6264665a882e73eb2262a74fea2c29b1921a9af33180126325fb67a851310ef
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      Xwrom/IconExtractor.dll
    • Size 10KB
    • SHA256 440912d85d2f98bb4f508ab82847067c18e1e15be0d8ecdcff0cc19327527fc2
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      Xwrom/NAudio.dll
    • Size 502KB
    • SHA256 81b3f1dc3f1eac9762b8a292751a44b64b87d0d4c3982debfdd2621012186451
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      Xwrom/Newtonsoft.Json.dll
    • Size 695KB
    • SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      Xwrom/Plugins/ActiveWindows.dll
    • Size 14KB
    • SHA256 567b9861026a0dbc5947e7515dc7ab3f496153f6b3db57c27238129ec207fc52
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      Xwrom/Plugins/Chat.dll
    • Size 18KB
    • SHA256 aab20f465955d77d6ec3b5c1c5f64402a925fb565dda5c8e38c296cb7406e492
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      Xwrom/Plugins/Chromium.dll
    • Size 32KB
    • SHA256 b6d8bccdf123ceac6b9642ad3500d4e0b3d30b9c9dd2d29499d38c02bd8f9982
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      Xwrom/Plugins/Clipboard.dll
    • Size 14KB
    • SHA256 e31a1c2b1baa2aa2c36cabe3da17cd767c8fec4c206bd506e889341e5e0fa959
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      Xwrom/Plugins/Cmstp-Bypass.dll
    • Size 11KB
    • SHA256 fa420fd3d1a5a2bb813ef8e6063480099f19091e8fa1b3389004c1ac559e806b
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      Xwrom/Plugins/FileManager.dll
    • Size 679KB
    • SHA256 b58ed3ebbcd27c7f4b173819528ff4db562b90475a5e304521ed5c564d39fffd
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      Xwrom/Plugins/FilesSearcher.dll
    • Size 478KB
    • SHA256 e66e1273dc59ee9e05ce3e02f1b760b18dd296a47d92b3ce5b24efb48e5fb21b
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      Xwrom/Plugins/HBrowser.dll
    • Size 25KB
    • SHA256 75e8ff57fa6d95cf4d8405bffebb2b9b1c55a0abba0fe345f55b8f0e88be6f3c
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      Xwrom/Plugins/HRDP.dll
    • Size 1.7MB
    • SHA256 4aa18745a5fddf7ec14adaff3ad1b4df1b910f4b6710bf55eb27fb3942bb67de
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      Xwrom/Plugins/HVNC.dll
    • Size 58KB
    • SHA256 3a287acb1c89692f2c18596dd4405089ac998bb9cf44dd225e5211923d421e96
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      Xwrom/Plugins/HVNCMemory.dll
    • Size 39KB
    • SHA256 285b462e3cd4a5b207315ad33ee6965a8b98ca58abb8d16882e4bc2d758ff1a4
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      Xwrom/Plugins/HiddenApps.dll
    • Size 45KB
    • SHA256 6a098f5a7f9328b35d73ee232846b13e2d587d47f473cbc9b3f1d74def7086ea
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      Xwrom/Plugins/Informations.dll
    • Size 22KB
    • SHA256 cba453460be46cfa705817abbe181f9bf65dca6b6cea1ad31629aa08dbeaf72b
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      Xwrom/Plugins/Keylogger.dll
    • Size 17KB
    • SHA256 acfe5c3aa2a3bae3437ead42e90044d7eee972ead25c1f7486bea4a23c201d3a
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      Xwrom/Plugins/Maps.dll
    • Size 15KB
    • SHA256 34b532a4d0560e26b0d5b81407befdc2424aacc9ef56e8b13de8ad0f4b3f1ab6
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      Xwrom/Plugins/MessageBox.dll
    • Size 14KB
    • SHA256 bc09b671894c9a36f4eca45dd6fbf958a967acea9e85b66c38a319387b90dd29
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      Xwrom/Plugins/Microphone.dll
    • Size 540KB
    • SHA256 612898afdf9120cfef5843f9b136c66ecc3e0bb6f3d1527d0599a11988b7783c
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      Xwrom/Plugins/Ngrok-Installer.dll
    • Size 400KB
    • SHA256 b574aabf02a65aa3b6f7bfff0a574873ce96429d3f708a10f87bc1f6518f14aa
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      Xwrom/Plugins/Options.dll
    • Size 30KB
    • SHA256 5c34aee5196e0f8615b8d1d9017dd710ea28d2b7ac99295d46046d12eea58d78
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      Xwrom/Plugins/Pastime.dll
    • Size 17KB
    • SHA256 a46787527ac34cd71d96226ddfc0a06370b61e4ad0267105be2aec8d82e984c1
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      Xwrom/Plugins/Performance.dll
    • Size 16KB
    • SHA256 043b6a0284468934582819996dbaa70b863ab4caa4f968c81c39a33b2ac81735
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      Xwrom/Plugins/ProcessManager.dll
    • Size 19KB
    • SHA256 7cf1921a5f8429b2b9e8197de195cfae2353fe0d8cb98e563bdf1e782fe2ee4e
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      Xwrom/Plugins/Programs.dll
    • Size 13KB
    • SHA256 953a8276faa4a18685d09cd9187ed3e409e3cccd7daf34b6097f1eb8d96125a4
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      Xwrom/Plugins/Ransomware.dll
    • Size 20KB
    • SHA256 14c2bbccdabb8408395d636b44b99de4b16db2e6bf35181cb71e7be516d83ad9
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10

MITRE ATT&CK Enterprise v15

Tasks

static1

agentteslastormkittyxworm
Score
10/10

behavioral1

discovery
Score
4/10

behavioral2

Score
1/10

behavioral3

Score
1/10

behavioral4

Score
1/10

behavioral5

Score
1/10

behavioral6

Score
1/10

behavioral7

Score
1/10

behavioral8

Score
1/10

behavioral9

Score
1/10

behavioral10

Score
1/10

behavioral11

Score
1/10

behavioral12

Score
1/10

behavioral13

Score
1/10

behavioral14

Score
1/10

behavioral15

Score
1/10

behavioral16

Score
1/10

behavioral17

Score
1/10

behavioral18

Score
1/10

behavioral19

Score
1/10

behavioral20

Score
1/10

behavioral21

Score
1/10

behavioral22

Score
1/10

behavioral23

Score
1/10

behavioral24

Score
1/10

behavioral25

Score
1/10

behavioral26

Score
1/10

behavioral27

Score
1/10

behavioral28

Score
1/10

behavioral29

Score
1/10

behavioral30

Score
1/10

behavioral31

Score
1/10

behavioral32

Score
1/10