Overview

overview

10

Static

static

10

3df057f43a...36.exe

windows7-x64

10

3df057f43a...36.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3df057f43a8c20c88fe2a2266ac09414fcf9dac4037e9a4f6e95ab66e6409636

  • Size

    59KB

  • Sample

    241101-y5sbcavgqq

  • MD5

    cf14fac9fa45e4989ad1db2910ed98fd

  • SHA1

    9e6381b831257bebf6356984e6ac3764aee72a84

  • SHA256

    3df057f43a8c20c88fe2a2266ac09414fcf9dac4037e9a4f6e95ab66e6409636

  • SHA512

    184a88c77ee9e8254cbe4489447d89a710b057efa6fe9f0510a93da91e200dd6717416b275140b31301fed6800884cc62b7941854565c96462f109dd7f972e0a

  • SSDEEP

    1536:PrCf7PCo/JsSQPbjCbBENluAAIA36VgOwR4Na:P2fjbhsSHbBE1bgOwUa

Score
10/10
xwormrattrojan

Malware Config

Extracted

Family

xworm

C2

assistance-arbitration.gl.at.ply.gg:12152

Attributes
  • Install_directory

    %AppData%

  • install_file

    svchost.exe

Targets

    • Target

      3df057f43a8c20c88fe2a2266ac09414fcf9dac4037e9a4f6e95ab66e6409636

    • Size

      59KB

    • MD5

      cf14fac9fa45e4989ad1db2910ed98fd

    • SHA1

      9e6381b831257bebf6356984e6ac3764aee72a84

    • SHA256

      3df057f43a8c20c88fe2a2266ac09414fcf9dac4037e9a4f6e95ab66e6409636

    • SHA512

      184a88c77ee9e8254cbe4489447d89a710b057efa6fe9f0510a93da91e200dd6717416b275140b31301fed6800884cc62b7941854565c96462f109dd7f972e0a

    • SSDEEP

      1536:PrCf7PCo/JsSQPbjCbBENluAAIA36VgOwR4Na:P2fjbhsSHbBE1bgOwUa

    Score
    10/10
    xwormrattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Xworm family

      xworm

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks