Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

XWorm V5.6.zip

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    XWorm V5.6.zip

  • Size

    17.3MB

  • Sample

    240816-ym4xesxcjm

  • MD5

    f5afa2b8b3702b8a63cc8f3ef5347c92

  • SHA1

    a2d3c8e8c082e05157db8e32d55c58ab22adb503

  • SHA256

    8ba9b12031e5f17c36580506ed7ee0c396175a7f569dafe47b800fbb83624a61

  • SHA512

    c1b84587484f89e5183e5d97819a28568ecd47ae55fdbfd53cc9493379c0110a2a1bb06cb5cafc35f44842f71dc50b02831474aed9cbb06b4043791f9893c13a

  • SSDEEP

    393216:GyaLq4XFeuBc9Q+FW7GMm389HCjIR7kjJPGAKbtUb8qcz:Gy74XDBYQw6GP2kjNKtpz

Score
10/10
agentteslastormkittyxwormpersistence

Malware Config

Extracted

Family

xworm

C2

127.0.0.1:59769

usr-contemporary.gl.at.ply.gg:59769
Attributes
  • Install_directory

    %Userprofile%

Targets

    • Target

      XWorm V5.6.zip

    • Size

      17.3MB

    • MD5

      f5afa2b8b3702b8a63cc8f3ef5347c92

    • SHA1

      a2d3c8e8c082e05157db8e32d55c58ab22adb503

    • SHA256

      8ba9b12031e5f17c36580506ed7ee0c396175a7f569dafe47b800fbb83624a61

    • SHA512

      c1b84587484f89e5183e5d97819a28568ecd47ae55fdbfd53cc9493379c0110a2a1bb06cb5cafc35f44842f71dc50b02831474aed9cbb06b4043791f9893c13a

    • SSDEEP

      393216:GyaLq4XFeuBc9Q+FW7GMm389HCjIR7kjJPGAKbtUb8qcz:Gy74XDBYQw6GP2kjNKtpz

    Score
    7/10
    persistence

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks