Overview

overview

10

Static

static

10

nursultan.exe

windows7-x64

10

nursultan.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    nursultan.exe

  • Size

    60KB

  • Sample

    241102-r3fffaxaqd

  • MD5

    9105e972f4ac2ef89c376baf88f2f98d

  • SHA1

    152ea2db5f0529c7bc6e373c5f0c3ca89b156220

  • SHA256

    5f8c50226b34130021e07f8cdb201d3ed8302680e0edd2cd8829ff8eb3e39bbf

  • SHA512

    2b2b56211cddc79a89014d96aa53b5cf2a61d60dc877a6890988f042be7c53356bee3cf1f6bd0ad11b64d53c95eb9c26dc6e4cf10dec025399e140b9e6535f0a

  • SSDEEP

    1536:fXZ47qwknRI0grWhHQmFCbRFSPrqEU2g47b6u/IEO5dE:BokbycCbRF+g479nO5dE

Score
10/10
xwormrattrojan

Malware Config

Extracted

Family

xworm

C2

23.ip.gl.ply.gg:40630

127.0.0.1:40630
Attributes
  • Install_directory

    %AppData%

  • install_file

    svchost.exe

Targets

    • Target

      nursultan.exe

    • Size

      60KB

    • MD5

      9105e972f4ac2ef89c376baf88f2f98d

    • SHA1

      152ea2db5f0529c7bc6e373c5f0c3ca89b156220

    • SHA256

      5f8c50226b34130021e07f8cdb201d3ed8302680e0edd2cd8829ff8eb3e39bbf

    • SHA512

      2b2b56211cddc79a89014d96aa53b5cf2a61d60dc877a6890988f042be7c53356bee3cf1f6bd0ad11b64d53c95eb9c26dc6e4cf10dec025399e140b9e6535f0a

    • SSDEEP

      1536:fXZ47qwknRI0grWhHQmFCbRFSPrqEU2g47b6u/IEO5dE:BokbycCbRF+g479nO5dE

    Score
    10/10
    xwormrattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Xworm family

      xworm

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks