Overview

overview

10

Static

static

10

290ab569c9...80.exe

windows7-x64

10

290ab569c9...80.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    290ab569c993fc3c2fcfeb1586eef058a0314893fc0c25219ba9915232a70280.exe

  • Size

    32KB

  • Sample

    241009-ppj6csyflh

  • MD5

    490ceab952abd5b62925e15f4b7aa533

  • SHA1

    8ea352821a52ea4daf51913ab1b193fc8b0417c2

  • SHA256

    290ab569c993fc3c2fcfeb1586eef058a0314893fc0c25219ba9915232a70280

  • SHA512

    eef0a6e1e0877ac549bae7408ef52fe59036be96f3f1694b19c466da64349a5a133ab169c177a3e7be09166e7cd39d230913ed6890e3942a5831706858b258b0

  • SSDEEP

    768:iVa+vNtg+PB93Tw4e1dVFE9jjXOjhybe:svNtgw93U4epFE9jjXOjYC

Score
10/10
xwormrattrojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

193.233.255.34:7777

Mutex

RPVmSS9pizbP4j38

Attributes
  • install_file

    USB.exe

aes.plain

Targets

    • Target

      290ab569c993fc3c2fcfeb1586eef058a0314893fc0c25219ba9915232a70280.exe

    • Size

      32KB

    • MD5

      490ceab952abd5b62925e15f4b7aa533

    • SHA1

      8ea352821a52ea4daf51913ab1b193fc8b0417c2

    • SHA256

      290ab569c993fc3c2fcfeb1586eef058a0314893fc0c25219ba9915232a70280

    • SHA512

      eef0a6e1e0877ac549bae7408ef52fe59036be96f3f1694b19c466da64349a5a133ab169c177a3e7be09166e7cd39d230913ed6890e3942a5831706858b258b0

    • SSDEEP

      768:iVa+vNtg+PB93Tw4e1dVFE9jjXOjhybe:svNtgw93U4epFE9jjXOjYC

    Score
    10/10
    xwormrattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks