Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

Stub.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Stub.exe

  • Size

    84KB

  • Sample

    241004-bxdrnaxbrn

  • MD5

    2234544e14c7e54e6f4d186b2fd76895

  • SHA1

    1d093861228c810fd8027ae27a92c7b2e79c606f

  • SHA256

    12d242765341882daf533c354c738074ed726e8e4af92f040d14b5d2ba992d94

  • SHA512

    b7af460b642288f40c0e1491e364959006018da2c2f42e98524da43ec208575a58d0d571a97861f5b1e2c8af844b6a5cc07b802d95abd4163e5d0d0768d813ea

  • SSDEEP

    1536:hUCfdRQM2DT3m/tTfpTGbqESA7fX6q6Rsxnuc8OyUbf2bd:hJPAm3CbqqX6NsN0OyU72d

Score
10/10
xwormrattrojan

Malware Config

Extracted

Family

xworm

C2

193.161.193.99:25993

Attributes
  • Install_directory

    %AppData%

  • install_file

    USB.exe

Targets

    • Target

      Stub.exe

    • Size

      84KB

    • MD5

      2234544e14c7e54e6f4d186b2fd76895

    • SHA1

      1d093861228c810fd8027ae27a92c7b2e79c606f

    • SHA256

      12d242765341882daf533c354c738074ed726e8e4af92f040d14b5d2ba992d94

    • SHA512

      b7af460b642288f40c0e1491e364959006018da2c2f42e98524da43ec208575a58d0d571a97861f5b1e2c8af844b6a5cc07b802d95abd4163e5d0d0768d813ea

    • SSDEEP

      1536:hUCfdRQM2DT3m/tTfpTGbqESA7fX6q6Rsxnuc8OyUbf2bd:hJPAm3CbqqX6NsN0OyU72d

    Score
    10/10
    xwormrattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1

MITRE ATT&CK Matrix

Tasks