Overview

overview

10

Static

static

10

cf0793dd79...63.exe

windows7-x64

10

cf0793dd79...63.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cf0793dd79285e039745f37cae227a8298191075cfb57672d7d36e0cdfef0d63

  • Size

    75KB

  • Sample

    241101-wezlmatfjq

  • MD5

    2c642c51cfc83fd4866a05d6a6b63be9

  • SHA1

    0b174996038b8326d7878971f08efd5a4c31aa67

  • SHA256

    cf0793dd79285e039745f37cae227a8298191075cfb57672d7d36e0cdfef0d63

  • SHA512

    4ac8c5e3146b9ac27e65e73b2c62bda61336d2821997464363b53beb5287a8a590c4b0a545b5c5f165f36a57ed1d30345a3e49ce8d9c083c8bc7ebf118d5df6b

  • SSDEEP

    1536:shfgMPrf/YopXX7TSeRuyhFq9HdBFbrDBYNiPR6KOijSe3gK:shfHP7PXrTSrWFq9HVbrqEPBOijS5K

Score
10/10
xwormrattrojan

Malware Config

Extracted

Family

xworm

C2

127.0.0.1:1016

Attributes
  • Install_directory

    %AppData%

  • install_file

    svchost-service.exe

  • telegram

    https://api.telegram.org/bot7299609726:AAF2JCjFJR7TmN4hpow1L_o0VYVcxdRdbkA

Targets

    • Target

      cf0793dd79285e039745f37cae227a8298191075cfb57672d7d36e0cdfef0d63

    • Size

      75KB

    • MD5

      2c642c51cfc83fd4866a05d6a6b63be9

    • SHA1

      0b174996038b8326d7878971f08efd5a4c31aa67

    • SHA256

      cf0793dd79285e039745f37cae227a8298191075cfb57672d7d36e0cdfef0d63

    • SHA512

      4ac8c5e3146b9ac27e65e73b2c62bda61336d2821997464363b53beb5287a8a590c4b0a545b5c5f165f36a57ed1d30345a3e49ce8d9c083c8bc7ebf118d5df6b

    • SSDEEP

      1536:shfgMPrf/YopXX7TSeRuyhFq9HdBFbrDBYNiPR6KOijSe3gK:shfHP7PXrTSrWFq9HVbrqEPBOijS5K

    Score
    10/10
    xwormrattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Xworm family

      xworm

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks