Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

System.exe

windows7-x64

10

System.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    System.exe

  • Size

    67KB

  • Sample

    240904-cez3lsvane

  • MD5

    5ee1967cc9cde8045b3c8f3a37f685f6

  • SHA1

    62429cb9fbbe082a579c6a908ec4e317cf6a3291

  • SHA256

    ddef68a4504b078ddd6f8c5f665898546eb019e2f134551f5b24909f51d668ec

  • SHA512

    386862a68a3c32d00f2b6fcc8361ad7379dada70b4f28d4ff8077d569b078574a1bc23b33755f9fc1960e69e6efb2182663f8120075e97a0012e1eacb186d014

  • SSDEEP

    1536:tRIUpAK1jniTJUnvPksl9jhK+bH51lT3RmAOvwX8RT:thpAK1jnzv/BK+bH5bT31OvwMt

Score
10/10
xwormpersistencerattrojan

Malware Config

Extracted

Family

xworm

C2

newstartagain.servequake.com:7001

newstartagain50.duckdns.org:7001
Attributes
  • Install_directory

    %AppData%

  • install_file

    USB.exe

  • telegram

    https://api.telegram.org/bot7114416350:AAF9PJoo6_MYxNu2qBazQWSWsWE1Jb_-yh8/sendMessage?chat_id=6653386349

Targets

    • Target

      System.exe

    • Size

      67KB

    • MD5

      5ee1967cc9cde8045b3c8f3a37f685f6

    • SHA1

      62429cb9fbbe082a579c6a908ec4e317cf6a3291

    • SHA256

      ddef68a4504b078ddd6f8c5f665898546eb019e2f134551f5b24909f51d668ec

    • SHA512

      386862a68a3c32d00f2b6fcc8361ad7379dada70b4f28d4ff8077d569b078574a1bc23b33755f9fc1960e69e6efb2182663f8120075e97a0012e1eacb186d014

    • SSDEEP

      1536:tRIUpAK1jniTJUnvPksl9jhK+bH51lT3RmAOvwX8RT:thpAK1jnzv/BK+bH5bT31OvwMt

    Score
    10/10
    xwormpersistencerattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks