Overview

overview

10

Static

static

10

GalaxySwapper.exe

windows7-x64

10

GalaxySwapper.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    GalaxySwapper.exe

  • Size

    169KB

  • Sample

    240902-wkt84avbpj

  • MD5

    465e6a6662415e49b65f59cb8ded03f1

  • SHA1

    082cb2d0e56c39c5c63e288865d44636dca3ad31

  • SHA256

    b04805a93e29a1417cb67150005ef27cc743f2ecbe0ef221257a16c3f0521977

  • SHA512

    46d966abf3ee8d219b80975c0cb328329edda73139a4a1463bac68b2d0f42a499cea45ec73fc085026ffc2a3c864becc34ade7be48549222541fe51aa6735b4c

  • SSDEEP

    3072:WzMVVI0kbXX6ElevOO37vBz65/M6If+3Js+3JFkKeTnL:WztnbnwxBt25

Score
10/10
xwormpersistencerattrojan

Malware Config

Extracted

Family

xworm

C2

agency-lottery.gl.at.ply.gg:21526

Attributes
  • Install_directory

    %AppData%

  • install_file

    startup.exe

  • telegram

    https://api.telegram.org/bot7375237961:AAFlPWXmEriRUUWDWeG1DeZifKaAFaWD10Q/sendMessage?chat_id=7534517325

Targets

    • Target

      GalaxySwapper.exe

    • Size

      169KB

    • MD5

      465e6a6662415e49b65f59cb8ded03f1

    • SHA1

      082cb2d0e56c39c5c63e288865d44636dca3ad31

    • SHA256

      b04805a93e29a1417cb67150005ef27cc743f2ecbe0ef221257a16c3f0521977

    • SHA512

      46d966abf3ee8d219b80975c0cb328329edda73139a4a1463bac68b2d0f42a499cea45ec73fc085026ffc2a3c864becc34ade7be48549222541fe51aa6735b4c

    • SSDEEP

      3072:WzMVVI0kbXX6ElevOO37vBz65/M6If+3Js+3JFkKeTnL:WztnbnwxBt25

    Score
    10/10
    xwormpersistencerattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks