Overview

overview

10

Static

static

10

10f23d2bb9...4N.exe

windows7-x64

10

10f23d2bb9...4N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    10f23d2bb9865c9a32b94dcd6057f8d866a60e5e39a3fb6fa77ede90005e87c4N

  • Size

    86KB

  • Sample

    241103-wyq4la1emk

  • MD5

    12095dbb7ef06f84fbb21054f0c33600

  • SHA1

    6f54c3f2f38e5fb7252c2a9d641c40fc1300bc22

  • SHA256

    10f23d2bb9865c9a32b94dcd6057f8d866a60e5e39a3fb6fa77ede90005e87c4

  • SHA512

    3c30f99df8a5da7a9a1c8ec0197a9b5fcdff6417c009e4cabdab60c65c6c19ae0076c291271c58a66090037f0b7d99ab2eec9ea254140578b93186b1dcf2751a

  • SSDEEP

    1536:1ubUIWL10oXnnnop+PBQwtGyybCnpeeL0t2Xz7M66T8NVO3755Ld3T:1u4vnopAAjbCpeeYtKfETmVOLZT

Score
10/10
xwormrattrojan

Malware Config

Extracted

Family

xworm

C2

great-amanda.gl.at.ply.gg:43926

oil-graphics.gl.at.ply.gg:43926

23.ip.gl.ply.gg:43926

oevn.zapto.org:43926

96.230.131.253:43926
Attributes
  • Install_directory

    %Userprofile%

  • install_file

    USB.exe

Targets

    • Target

      10f23d2bb9865c9a32b94dcd6057f8d866a60e5e39a3fb6fa77ede90005e87c4N

    • Size

      86KB

    • MD5

      12095dbb7ef06f84fbb21054f0c33600

    • SHA1

      6f54c3f2f38e5fb7252c2a9d641c40fc1300bc22

    • SHA256

      10f23d2bb9865c9a32b94dcd6057f8d866a60e5e39a3fb6fa77ede90005e87c4

    • SHA512

      3c30f99df8a5da7a9a1c8ec0197a9b5fcdff6417c009e4cabdab60c65c6c19ae0076c291271c58a66090037f0b7d99ab2eec9ea254140578b93186b1dcf2751a

    • SSDEEP

      1536:1ubUIWL10oXnnnop+PBQwtGyybCnpeeL0t2Xz7M66T8NVO3755Ld3T:1u4vnopAAjbCpeeYtKfETmVOLZT

    Score
    10/10
    xwormrattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Xworm family

      xworm

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks