Overview

overview

10

Static

static

10

Nigga.exe

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    Nigga.exe

  • Size

    88KB

  • Sample

    241003-baltrawbrq

  • MD5

    d860953f40e15b729528516b75b1b8d2

  • SHA1

    b850bf686298e0c1f096abbe1db6c61b0b5c7882

  • SHA256

    f8c16c1fa1a4705afcb503e92324dbb699a3463d533227a028eca5005a63a161

  • SHA512

    22962fbefa78ec92777a2bea7f0d1381425344fe4ad8ae644a9a4e7e7e1cf3ae868536ac13d330a0fba263236e38705a39210afd074d6a9d342a9cd922c405cd

  • SSDEEP

    1536:+t0KaJVbytqqRoMFWvaoOtbx9pWa3vdR6/ggjyYO+0Nw6UMkGVJn:+t0KbFFWva9tbxlR8JOfi6UMdXn

Score
10/10
xwormrattrojan

Malware Config

Extracted

Family

xworm

C2

series-ate.gl.at.ply.gg:62459

Attributes
  • Install_directory

    %Userprofile%

  • install_file

    USB.exe

Targets

    • Target

      Nigga.exe

    • Size

      88KB

    • MD5

      d860953f40e15b729528516b75b1b8d2

    • SHA1

      b850bf686298e0c1f096abbe1db6c61b0b5c7882

    • SHA256

      f8c16c1fa1a4705afcb503e92324dbb699a3463d533227a028eca5005a63a161

    • SHA512

      22962fbefa78ec92777a2bea7f0d1381425344fe4ad8ae644a9a4e7e7e1cf3ae868536ac13d330a0fba263236e38705a39210afd074d6a9d342a9cd922c405cd

    • SSDEEP

      1536:+t0KaJVbytqqRoMFWvaoOtbx9pWa3vdR6/ggjyYO+0Nw6UMkGVJn:+t0KbFFWva9tbxlR8JOfi6UMdXn

    Score
    10/10
    xwormrattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1

MITRE ATT&CK Matrix

Tasks