Overview

overview

10

Static

static

10

Network.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Network.exe

  • Size

    82KB

  • Sample

    241109-p6khfsxngj

  • MD5

    4c69483ff0c35be5ab917fe321fcdf25

  • SHA1

    40845d144583d6e06ebd1bf0e36975cc5068c669

  • SHA256

    be6efed1679ba6aaaa8108b53c046101a056b110aff2218116e2fb2f5ecb5fbc

  • SHA512

    9c42bd25cc2d83b306621d95e31cc2ee07742cb98cd8787dd3659ecdd4ec8885407537028cb5e36144b1b00205f4636aa231aed4aa371148400e747141c0cfc7

  • SSDEEP

    1536:3mVE/FEa5mweETDXc1tJbsCLdLJQM5uM6dslOtwGCy:3mCFBeE/c5bsCZRu/slOtw4

Score
10/10
xwormrattrojan

Malware Config

Extracted

Family

xworm

Version

5.0

Attributes
  • Install_directory

    %AppData%

  • install_file

    NetworkEX.exe

  • pastebin_url

    https://pastebin.com/raw/jGuGV3jT

  • telegram

    https://api.telegram.org/bot6554307825:AAFiCM4YZlx7R1yb0K0d5pqenjePI2Nljfc/sendMessage?chat_id=6077384108

Targets

    • Target

      Network.exe

    • Size

      82KB

    • MD5

      4c69483ff0c35be5ab917fe321fcdf25

    • SHA1

      40845d144583d6e06ebd1bf0e36975cc5068c669

    • SHA256

      be6efed1679ba6aaaa8108b53c046101a056b110aff2218116e2fb2f5ecb5fbc

    • SHA512

      9c42bd25cc2d83b306621d95e31cc2ee07742cb98cd8787dd3659ecdd4ec8885407537028cb5e36144b1b00205f4636aa231aed4aa371148400e747141c0cfc7

    • SSDEEP

      1536:3mVE/FEa5mweETDXc1tJbsCLdLJQM5uM6dslOtwGCy:3mCFBeE/c5bsCZRu/slOtw4

    Score
    10/10
    xwormrattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Xworm family

      xworm

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks