General

  • Target

    24031946159d6c0bf59f80f36e2e3c5cc7c9f022af287c7dbac262eb88e01cbf.exe

  • Size

    33KB

  • Sample

    241107-cm9xsataqf

  • MD5

    999e4da3f5065f404bf6ff7b704b93a8

  • SHA1

    a793f5ecd70dfded68f8c9415cd189202ce0451e

  • SHA256

    24031946159d6c0bf59f80f36e2e3c5cc7c9f022af287c7dbac262eb88e01cbf

  • SHA512

    2d1cd73ab52319a25101c377f955619bafe03938e53a5bca0e8339ed1127f5e7b47c077a10edba91d3482a07003a1656e8323059711a8dc7c9ea793d9a3793af

  • SSDEEP

    768:Y4fK1pDGkptwyZScCBSUapNgqlGU/kZl+Bcgo5tlTF592IO9hHdRq:IDGkptwyZScCkU4rAUsZcB5o5HF592IV

Score
10/10

Malware Config

Extracted

Family

xworm

Version

3.1

C2

jameshde18.duckdns.org:8895

Mutex

thoq1B68iBqp1ITN

Attributes
  • install_file

    USB.exe

aes.plain

Targets

    • Target

      24031946159d6c0bf59f80f36e2e3c5cc7c9f022af287c7dbac262eb88e01cbf.exe

    • Size

      33KB

    • MD5

      999e4da3f5065f404bf6ff7b704b93a8

    • SHA1

      a793f5ecd70dfded68f8c9415cd189202ce0451e

    • SHA256

      24031946159d6c0bf59f80f36e2e3c5cc7c9f022af287c7dbac262eb88e01cbf

    • SHA512

      2d1cd73ab52319a25101c377f955619bafe03938e53a5bca0e8339ed1127f5e7b47c077a10edba91d3482a07003a1656e8323059711a8dc7c9ea793d9a3793af

    • SSDEEP

      768:Y4fK1pDGkptwyZScCBSUapNgqlGU/kZl+Bcgo5tlTF592IO9hHdRq:IDGkptwyZScCkU4rAUsZcB5o5HF592IV

    Score
    10/10
    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

    • Xworm family

MITRE ATT&CK Matrix

Tasks