Overview

overview

10

Static

static

10

XWorm V5.4....4.exe

windows7-x64

7

XWorm V5.4....4.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    XWorm V5.4.rar

  • Size

    25.8MB

  • Sample

    241102-pzyrhavbkc

  • MD5

    bf9ac6288eae16a84359b0c4ea4ae847

  • SHA1

    8c95095b164e23e67d0d387b76807f08021a4245

  • SHA256

    456ba538a6fa8751897a9a76aa88d69c0c01011af42a1a8f331204978424f456

  • SHA512

    2bd97dcd75c478feaf4fc882b4a8d0fb27acbfe763e1f48d2740b37c993cbe920e92e9c83fe2cb75e248690687f8e950cf25a0d40d716feb6f6f52596116eda9

  • SSDEEP

    786432:UysUBxS7MybZCJxMJW18BQwEUuRtrftYodqS2:XBUIGQJ2g1orElrfhr2

Score
10/10
stormkittyxwormagilenet

Malware Config

Extracted

Family

xworm

C2

127.0.0.1:7000

Attributes
  • install_file

    USB.exe

Targets

    • Target

      XWorm V5.4/XWorm V5.4.exe

    • Size

      13.8MB

    • MD5

      efb0528d6978337e964d999dacb621df

    • SHA1

      244979b8495d3d173a4359d62ad771f99a0033fc

    • SHA256

      4786ac3ceb9ecdcb98bdd19a0e93750e6c9c0df460751994840f8ea9733cc491

    • SHA512

      4b16aca5638094741a9e5f0e4581b5c3cdbd77835035362468d2a0e077fba0f96b8dd98c4a4ea853b3b623d5b525fe64091daa1b761597b660840a371fbae0df

    • SSDEEP

      196608:msZttF81Wco24/vt8Kf67RQCTbJev4Z4t2WL8PSlsZA6G:mEtM1VR4cRZ0QZaL8qlsZVG

    Score
    7/10
    agilenet

    • Loads dropped DLL

    • Obfuscated with Agile.Net obfuscator

      Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

      agilenet
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks