Overview

overview

10

Static

static

10

1220.exe

windows7-x64

10

1220.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    1220.exe

  • Size

    33KB

  • Sample

    240914-t1813stgna

  • MD5

    746577f77d116be5548fe36ecf69653e

  • SHA1

    ff8b367092c14c31b3f11e633248d0913f65a94f

  • SHA256

    fdc004f1ae0e35bb9876ef0764d45841551f06cdb20a9f749ef5e9e3f8ec0215

  • SHA512

    8534745bc6e0fcdaf10d2a7e557ded0a0f9053dd238e2534989fa10894aa9ce1370dadc4515f0696f49454e30495b95a11138e9e203b85a301b20305a4f06f4a

  • SSDEEP

    384:kkmaqH1PJUt8bOoTz5LzNz3Tm2eaFOzFzRApkFTBLTsOZwpGd2v99IkuisHfYVFS:ZiHDD5FZz3Tw4OFzVFE9jefKOjhwbm

Score
10/10
xwormrattrojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

wafflemafia.top:1220

honesty24.duckdns.org:1220

havertz.duckdns.org:1220

freedom24.duckdns.org:1220
Mutex

sNb0G0pWm5AOvhqF

Attributes
  • install_file

    USB.exe

aes.plain

Targets

    • Target

      1220.exe

    • Size

      33KB

    • MD5

      746577f77d116be5548fe36ecf69653e

    • SHA1

      ff8b367092c14c31b3f11e633248d0913f65a94f

    • SHA256

      fdc004f1ae0e35bb9876ef0764d45841551f06cdb20a9f749ef5e9e3f8ec0215

    • SHA512

      8534745bc6e0fcdaf10d2a7e557ded0a0f9053dd238e2534989fa10894aa9ce1370dadc4515f0696f49454e30495b95a11138e9e203b85a301b20305a4f06f4a

    • SSDEEP

      384:kkmaqH1PJUt8bOoTz5LzNz3Tm2eaFOzFzRApkFTBLTsOZwpGd2v99IkuisHfYVFS:ZiHDD5FZz3Tw4OFzVFE9jefKOjhwbm

    Score
    10/10
    xwormrattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks