General
-
Target
https://cdn.discordapp.com/attachments/1226239279185920071/1226281254140510389/XWorm_v5.6_Edition_By_WantHacks.rar?ex=672e816a&is=672d2fea&hm=920c7506be69d3c5979796dc4f7d4cefd18a18ff3e0fc7923ac8ee2206d5c408&
-
Sample
241107-186dgsynbx
Score
10/10
Malware Config
Extracted
Family
xworm
Version
5.0
C2
127.0.0.1:7000
Mutex
bCIPMuXfvOSef1Ru
Attributes
-
install_file
USB.exe
aes.plain
Extracted
Family
xworm
C2
127.0.0.1:7000
Attributes
-
install_file
USB.exe
Targets
-
-
Target
https://cdn.discordapp.com/attachments/1226239279185920071/1226281254140510389/XWorm_v5.6_Edition_By_WantHacks.rar?ex=672e816a&is=672d2fea&hm=920c7506be69d3c5979796dc4f7d4cefd18a18ff3e0fc7923ac8ee2206d5c408&
Score10/10-
Detect Xworm Payload
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Executes dropped EXE
-
Uses the VBS compiler for execution
-