Overview

overview

10

Static

static

10

XWorm-v5.6...rp.exe

windows7-x64

10

XWorm-v5.6...rp.exe

windows10-2004-x64

10

XWorm-v5.6...ox.dll

windows7-x64

1

XWorm-v5.6...ox.dll

windows10-2004-x64

1

XWorm-v5.6...er.bat

windows7-x64

1

XWorm-v5.6...er.bat

windows10-2004-x64

1

XWorm-v5.6...re.dll

windows7-x64

1

XWorm-v5.6...re.dll

windows10-2004-x64

1

XWorm-v5.6...ms.dll

windows7-x64

1

XWorm-v5.6...ms.dll

windows10-2004-x64

1

XWorm-v5.6...I2.dll

windows7-x64

1

XWorm-v5.6...I2.dll

windows10-2004-x64

1

XWorm-v5.6...or.dll

windows7-x64

1

XWorm-v5.6...or.dll

windows10-2004-x64

1

XWorm-v5.6...io.dll

windows7-x64

1

XWorm-v5.6...io.dll

windows10-2004-x64

1

XWorm-v5.6...on.dll

windows7-x64

1

XWorm-v5.6...on.dll

windows10-2004-x64

1

XWorm-v5.6...ws.dll

windows7-x64

1

XWorm-v5.6...ws.dll

windows10-2004-x64

1

XWorm-v5.6...at.dll

windows7-x64

1

XWorm-v5.6...at.dll

windows10-2004-x64

1

XWorm-v5.6...um.dll

windows7-x64

1

XWorm-v5.6...um.dll

windows10-2004-x64

1

XWorm-v5.6...rd.dll

windows7-x64

1

XWorm-v5.6...rd.dll

windows10-2004-x64

1

XWorm-v5.6...ss.dll

windows7-x64

1

XWorm-v5.6...ss.dll

windows10-2004-x64

1

XWorm-v5.6...er.dll

windows7-x64

1

XWorm-v5.6...er.dll

windows10-2004-x64

1

XWorm-v5.6...er.dll

windows7-x64

1

XWorm-v5.6...er.dll

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    XWorm-v5.6-Lifetime-Editon-Cracked.rar

  • Size

    24.4MB

  • Sample

    240914-xgxqgszbpn

  • MD5

    35c2352086d632af8df2b06aa235aa65

  • SHA1

    5363bccd0bd9e0626904d0c8cdfbee09f9453e22

  • SHA256

    4c7d6cf21cefb460a9c8cf9860b3a4baf11505c876e60b247e5b6ea85b46e8cb

  • SHA512

    27da56db40ccd254ec19552fb618ad2b72bbb2c5dc887cdab693a0daeabd9cc20415604e359dc7d25e61f0d1389e72b3b573febd989c2fc657defd4b40905be0

  • SSDEEP

    786432:wyWY0S5vBTkNPurr3hEWBsrV8bncwApLD:e+jk0rr3hFBU6bcwMP

Score
10/10
agentteslastormkittyxwormkeyloggerspywarestealertrojan

Malware Config

Targets

    • Target

      XWorm-v5.6-Lifetime-Editon-Cracked/CefSharp.cfg

    • Size

      10.8MB

    • MD5

      acff16b9fae109888d772998b91ccca4

    • SHA1

      b580c68d4d2bf3cc26393728337278f190d405f1

    • SHA256

      5cae75e6d6a6b249b2d977158998aaa514b8c917c313b5a0609c7b90b075ae50

    • SHA512

      557aadc06ca2a961ca44b6e4f46cbe412d605dab2092bee16118baaa8a4a02eecbd746ba615d0af9eddd38ed67d81ef44dd1313956a32a4798a4018d24377962

    • SSDEEP

      196608:4gavfJVzbFUbwD5PVO47xgO2JC85cikjYA/cmiV7ZNt/ikyM:hIhBbFUcBVO47xg/C3P/eJVyM

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

    • Target

      XWorm-v5.6-Lifetime-Editon-Cracked/FastColoredTextBox.dll

    • Size

      333KB

    • MD5

      b746707265772b362c0ba18d8d630061

    • SHA1

      4b185e5f68c00bef441adb737d0955646d4e569a

    • SHA256

      3701b19ccdac79b880b197756a972027e2ac609ebed36753bd989367ea4ef519

    • SHA512

      fd67f6c55940509e8060da53693cb5fbac574eb1e79d5bd8f9bbd43edbd05f68d5f73994798a0eed676d3e583e1c6cde608b54c03604b3818520fa18ad19aec8

    • SSDEEP

      6144:4FErOIif3RzSHh+20lXs1TzCeBcQeDbNlz7:eEeR52bmeh0n

    Score
    1/10
    behavioral3behavioral4

    • Target

      XWorm-v5.6-Lifetime-Editon-Cracked/Fixer.bat

    • Size

      122B

    • MD5

      2dabc46ce85aaff29f22cd74ec074f86

    • SHA1

      208ae3e48d67b94cc8be7bbfd9341d373fa8a730

    • SHA256

      a11703fd47d16020fa099a95bb4e46247d32cf8821dc1826e77a971cdd3c4c55

    • SHA512

      6a50b525bc5d8eb008b1b0d704f9942f72f1413e65751e3de83d2e16ef3cf02ef171b9da3fff0d2d92a81daac7f61b379fcf7a393f46e914435f6261965a53b3

    Score
    1/10
    behavioral5behavioral6

    • Target

      XWorm-v5.6-Lifetime-Editon-Cracked/GMap.NET.Core.dll

    • Size

      2.9MB

    • MD5

      819352ea9e832d24fc4cebb2757a462b

    • SHA1

      aba7e1b29bdcd0c5a307087b55c2ec0c7ca81f11

    • SHA256

      58c755fcfc65cddea561023d736e8991f0ad69da5e1378dea59e98c5db901b86

    • SHA512

      6a5b0e1553616ea29ec72c12072ae05bdd709468a173e8adbdfe391b072c001ecacb3dd879845f8d599c6152eca2530cdaa2c069b1f94294f778158eaaebe45a

    • SSDEEP

      49152:ot12Gb/hz7ZsK9qY5uyUW57VC4IB1+fXhQ1hyCzMw/22fSg7gjxhUE/nbTC0xemh:oLbteKb57W1+PhQ1HM1gmJ/SZmh

    Score
    1/10
    behavioral7behavioral8

    • Target

      XWorm-v5.6-Lifetime-Editon-Cracked/GMap.NET.WindowsForms.dll

    • Size

      147KB

    • MD5

      32a8742009ffdfd68b46fe8fd4794386

    • SHA1

      de18190d77ae094b03d357abfa4a465058cd54e3

    • SHA256

      741e1a8f05863856a25d101bd35bf97cba0b637f0c04ecb432c1d85a78ef1365

    • SHA512

      22418d5e887a6022abe8a7cbb0b6917a7478d468d211eecd03a95b8fb6452fc59db5178573e25d5d449968ead26bb0b2bfbfada7043c9a7a1796baca5235a82b

    • SSDEEP

      3072:k1GmgYqIY/0YSDBRGlDUqL63budipxj64m8HWYh3vHbFwMhLJSb+:lIO6rGloqL63qW62lJ

    Score
    1/10
    behavioral10behavioral9

    • Target

      XWorm-v5.6-Lifetime-Editon-Cracked/Guna.UI2.dll

    • Size

      1.9MB

    • MD5

      bcc0fe2b28edd2da651388f84599059b

    • SHA1

      44d7756708aafa08730ca9dbdc01091790940a4f

    • SHA256

      c6264665a882e73eb2262a74fea2c29b1921a9af33180126325fb67a851310ef

    • SHA512

      3bfc3d27c095dde988f779021d0479c8c1de80a404454813c6cae663e3fe63dc636bffa7de1094e18594c9d608fa7420a0651509544722f2a00288f0b7719cc8

    • SSDEEP

      24576:FIVZLRYIVQd9INo3FDbWX7SsOobBTEAjg+m+ZFNwaxwGoHQ/jzK+:+oWodbi9XFEAjg+m+ZFKaxw

    Score
    1/10
    behavioral11behavioral12

    • Target

      XWorm-v5.6-Lifetime-Editon-Cracked/IconExtractor.dll

    • Size

      10KB

    • MD5

      640d8ffa779c6dd5252a262e440c66c0

    • SHA1

      3252d8a70a18d5d4e0cc84791d587dd12a394c2a

    • SHA256

      440912d85d2f98bb4f508ab82847067c18e1e15be0d8ecdcff0cc19327527fc2

    • SHA512

      e12084f87bd46010aded22be30e902c5269a6f6bc88286d3bef17c71d070b17beada0fe9e691a2b2f76202b5f9265329f6444575f89aff8551c486eafe4d5f32

    • SSDEEP

      192:7f77J4cGYyfQknxLvIgyLY5xJeU5pPpZlEAs:HS2yINgyLYLJR5wl

    Score
    1/10
    behavioral13behavioral14

    • Target

      XWorm-v5.6-Lifetime-Editon-Cracked/NAudio.dll

    • Size

      502KB

    • MD5

      3b87d1363a45ce9368e9baec32c69466

    • SHA1

      70a9f4df01d17060ec17df9528fca7026cc42935

    • SHA256

      81b3f1dc3f1eac9762b8a292751a44b64b87d0d4c3982debfdd2621012186451

    • SHA512

      1f07d3b041763b4bc31f6bd7b181deb8d34ff66ec666193932ffc460371adbcd4451483a99009b9b0b71f3864ed5c15c6c3b3777fabeb76f9918c726c35eb7d7

    • SSDEEP

      6144:96/i10SZtfzWctj98vZcE0wmLlaIZs5eku2sX2hrjAzvgmXa6W9FwsT9idwktQZG:9yrSKMJR9aGs55T1X9Fwspi2tGpmS

    Score
    1/10
    behavioral15behavioral16

    • Target

      XWorm-v5.6-Lifetime-Editon-Cracked/Newtonsoft.Json.dll

    • Size

      695KB

    • MD5

      195ffb7167db3219b217c4fd439eedd6

    • SHA1

      1e76e6099570ede620b76ed47cf8d03a936d49f8

    • SHA256

      e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d

    • SHA512

      56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac

    • SSDEEP

      12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/

    Score
    1/10
    behavioral17behavioral18

    • Target

      XWorm-v5.6-Lifetime-Editon-Cracked/Plugins/ActiveWindows.dll

    • Size

      14KB

    • MD5

      5a766a4991515011983ceddf7714b70b

    • SHA1

      4eb00ae7fe780fa4fe94cedbf6052983f5fd138b

    • SHA256

      567b9861026a0dbc5947e7515dc7ab3f496153f6b3db57c27238129ec207fc52

    • SHA512

      4bd6b24e236387ff58631207ea42cd09293c3664468e72cd887de3b3b912d3795a22a98dcf4548fb339444337722a81f8877abb22177606d765d78e48ec01fd8

    • SSDEEP

      384:vRt5r7olU5QrGPbMrodT8ptsY7XZ1EDI6:vRtSRrGPb9t0Z1ED7

    Score
    1/10
    behavioral19behavioral20

    • Target

      XWorm-v5.6-Lifetime-Editon-Cracked/Plugins/Chat.dll

    • Size

      18KB

    • MD5

      59f75c7ffaccf9878a9d39e224a65adf

    • SHA1

      46b0f61a07e85e3b54b728d9d7142ddc73c9d74b

    • SHA256

      aab20f465955d77d6ec3b5c1c5f64402a925fb565dda5c8e38c296cb7406e492

    • SHA512

      80056163b96ce7a8877874eaae559f75217c0a04b3e3d4c1283fe23badfc95fe4d587fd27127db4be459b8a3adf41900135ea12b0eeb4187adbcf796d9505cb8

    • SSDEEP

      384:4MOna4ifKQtuUvl0BY0iYUsBG/crwTKvh6GIKoIafWUWmfN:vKQtuq2Y0lUUG0r0pIafWXe

    Score
    1/10
    behavioral21behavioral22

    • Target

      XWorm-v5.6-Lifetime-Editon-Cracked/Plugins/Chromium.dll

    • Size

      32KB

    • MD5

      edb2f0d0eb08dcd78b3ddf87a847de01

    • SHA1

      cc23d101f917cad3664f8c1fa0788a89e03a669c

    • SHA256

      b6d8bccdf123ceac6b9642ad3500d4e0b3d30b9c9dd2d29499d38c02bd8f9982

    • SHA512

      8f87da834649a21a908c95a9ea8e2d94726bd9f33d4b7786348f6371dfae983cc2b5b5d4f80a17a60ded17d4eb71771ec25a7c82e4f3a90273c46c8ee3b8f2c3

    • SSDEEP

      768:6SyQlmUmBlEu0FXfjq2sgDrLjfcVJ5sN9aWdMIxbKhJ+GEq3ZsL5f62:3yQltmBlmFXfjq2sgDrLjfcVJ5sNkQOa

    Score
    1/10
    behavioral23behavioral24

    • Target

      XWorm-v5.6-Lifetime-Editon-Cracked/Plugins/Clipboard.dll

    • Size

      14KB

    • MD5

      831eb0de839fc13de0abab64fe1e06e7

    • SHA1

      53aad63a8b6fc9e35c814c55be9992abc92a1b54

    • SHA256

      e31a1c2b1baa2aa2c36cabe3da17cd767c8fec4c206bd506e889341e5e0fa959

    • SHA512

      2f61bcf972671d96e036b3c99546cd01e067bef15751a87c00ba6d656decb6b69a628415e5363e650b55610cf9f237585ada7ce51523e6efc0e27d7338966bee

    • SSDEEP

      192:xh23MTInqHX7qRlrZk1/X7eOFXgNTer149iY6IW1mX/YWMqS7RSLOIU:cTWElV0/X7eUSTe5Wi2X/ShIU

    Score
    1/10
    behavioral25behavioral26

    • Target

      XWorm-v5.6-Lifetime-Editon-Cracked/Plugins/Cmstp-Bypass.dll

    • Size

      11KB

    • MD5

      cf15259e22b58a0dfd1156ab71cbd690

    • SHA1

      3614f4e469d28d6e65471099e2d45c8e28a7a49e

    • SHA256

      fa420fd3d1a5a2bb813ef8e6063480099f19091e8fa1b3389004c1ac559e806b

    • SHA512

      7302a424ed62ec20be85282ff545a4ca9e1aecfe20c45630b294c1ae72732465d8298537ee923d9e288ae0c48328e52ad8a1a503e549f8f8737fabe2e6e9ad38

    • SSDEEP

      192:KpXpS1QWlPkiqdE7FNNGGO9mWbpGkjgyaYcIW1vr/8TNU7aL7YiLsO08hdW5:Kp5IfL0mWbEkUyaYir/oNJL7KQ

    Score
    1/10
    behavioral27behavioral28

    • Target

      XWorm-v5.6-Lifetime-Editon-Cracked/Plugins/FileManager.dll

    • Size

      679KB

    • MD5

      641a8b61cb468359b1346a0891d65b59

    • SHA1

      2cdc49bcd7428fe778a94cdcd19cabf5ece8c9c0

    • SHA256

      b58ed3ebbcd27c7f4b173819528ff4db562b90475a5e304521ed5c564d39fffd

    • SHA512

      042702d34664ea6288e891c9f7aa10a5b4b07317f25f82d6c9fa9ba9b98645c14073d0f66637060b416a30c58dec907d9383530320a318523c51f19ebd0a4fee

    • SSDEEP

      12288:bVnchrRTHcQ3nrn6xtI9qR5WcygA5KeirCDD/:btJQ3nrnMI9MUlr5Kei+DD/

    Score
    1/10
    behavioral29behavioral30

    • Target

      XWorm-v5.6-Lifetime-Editon-Cracked/Plugins/FilesSearcher.dll

    • Size

      478KB

    • MD5

      6f8f1621c16ac0976600146d2217e9d2

    • SHA1

      b6aa233b93aae0a17ee8787576bf0fbc05cedde4

    • SHA256

      e66e1273dc59ee9e05ce3e02f1b760b18dd296a47d92b3ce5b24efb48e5fb21b

    • SHA512

      eb55acdea8648c8cdefee892758d9585ff81502fc7037d5814e1bd01fee0431f4dde0a4b04ccb2b0917e1b11588f2dc9f0bfe750117137a01bbd0c508f43ef6a

    • SSDEEP

      6144:ZAHdfUpnnBuIbE7SCQeGtSV41QJDsTDDh0Yhe6dwxLV/Quhg08OwR75:yVUpnkZ7slS4Ys50ie6Cfzg0M

    Score
    1/10
    behavioral31behavioral32

MITRE ATT&CK Enterprise v15

Tasks

static1

agentteslastormkittyxworm
Score
10/10

behavioral1

agentteslakeyloggerspywarestealertrojan
Score
10/10

behavioral2

agentteslakeyloggerspywarestealertrojan
Score
10/10

behavioral3

Score
1/10

behavioral4

Score
1/10

behavioral5

Score
1/10

behavioral6

Score
1/10

behavioral7

Score
1/10

behavioral8

Score
1/10

behavioral9

Score
1/10

behavioral10

Score
1/10

behavioral11

Score
1/10

behavioral12

Score
1/10

behavioral13

Score
1/10

behavioral14

Score
1/10

behavioral15

Score
1/10

behavioral16

Score
1/10

behavioral17

Score
1/10

behavioral18

Score
1/10

behavioral19

Score
1/10

behavioral20

Score
1/10

behavioral21

Score
1/10

behavioral22

Score
1/10

behavioral23

Score
1/10

behavioral24

Score
1/10

behavioral25

Score
1/10

behavioral26

Score
1/10

behavioral27

Score
1/10

behavioral28

Score
1/10

behavioral29

Score
1/10

behavioral30

Score
1/10

behavioral31

Score
1/10

behavioral32

Score
1/10