Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    2f38d2f40f80df0ce510c5c5a35c463e26ed1a2886c1a8cffcc406630551476b

  • Size

    56KB

  • Sample

    240818-fx973sxelh

  • MD5

    315566bb8899185bbd85056e7ed898a4

  • SHA1

    0096bec2059e253ea971f520e7ac6f755d953e10

  • SHA256

    2f38d2f40f80df0ce510c5c5a35c463e26ed1a2886c1a8cffcc406630551476b

  • SHA512

    2fc65aab8880c4d83796d5970c63c8fd7ee7b470da4644f500c1482530707ee37e31ce03f881e3664f4717f35709cec64ee44f45ab22ee0b47b108cf2340e8ec

  • SSDEEP

    768:pIvxNr47QZI+bBjYxrhExA1a6lHS6f1UFNBGzs/QZ46wkh3qL0RBuR2w/9kd6jhH:p8xp47Qy6bUiTEzUo4doSzmd63E+

Malware Config

Extracted

Family

xworm

Version

3.1

C2

179.118.199.252:7771

Attributes
  • Install_directory

    %AppData%

  • install_file

    USB.exe

Targets

    • Target

      9f70eceb0e6a3dc06079b42532fa03651e8f9e43140d6d7e4b6e4d2dea5486d3.exe

    • Size

      89KB

    • MD5

      7758ee1f6165c9cec1113f8b1b7c1b72

    • SHA1

      5e5fa255f2e0c2eb0c02dd055ba0004292a8cf70

    • SHA256

      9f70eceb0e6a3dc06079b42532fa03651e8f9e43140d6d7e4b6e4d2dea5486d3

    • SHA512

      6a70f60b0ee566cb5d26f6fad36c440cca5d9f89fce2d3355b222b499b321b0fa4d4cdab74a4fd98d4286450235d7eaaf8bc0eef6a13d2404121428a657ef612

    • SSDEEP

      1536:YKpPAEG0RI/8PXVd4rbIlUSgwlpZr9O0Eik23C7Hx:jIEGH0PFdKbIlqwlp59O0EiN3C

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v15

Tasks