Overview

overview

10

Static

static

10

e07cf3548d...2N.exe

windows7-x64

10

e07cf3548d...2N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e07cf3548d51bb01fc5eaa62ac40723b425f2a092553ae397b402952cfbd7f12N

  • Size

    40KB

  • Sample

    241110-tpeyvszlax

  • MD5

    186a08ac7b314ee4daae873ee6e06bc0

  • SHA1

    711aaa1dca5db54d914587bfbc5ac84150c1ff26

  • SHA256

    e07cf3548d51bb01fc5eaa62ac40723b425f2a092553ae397b402952cfbd7f12

  • SHA512

    ada780135d0ca44cb90d5fbf646ac65a6aefb2d97cc9095a82f50a19954fe7dc953090cc79aba5242e696b8aa178fd4134fae4b1f9b242c60afb79376ccdda4d

  • SSDEEP

    768:oxAMnhNNnAcU9atkEayDmxNi+BJF5Pt9OY3X6BOMhF3/J1:oxLJnAcUuJaF6YFD993X6BOMzb

Score
10/10
xwormrattrojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

score-responding.gl.at.ply.gg:17538

Mutex

w38vggbXjK9JyQSb

Attributes
  • Install_directory

    %AppData%

  • install_file

    conhost.exe

aes.plain

Targets

    • Target

      e07cf3548d51bb01fc5eaa62ac40723b425f2a092553ae397b402952cfbd7f12N

    • Size

      40KB

    • MD5

      186a08ac7b314ee4daae873ee6e06bc0

    • SHA1

      711aaa1dca5db54d914587bfbc5ac84150c1ff26

    • SHA256

      e07cf3548d51bb01fc5eaa62ac40723b425f2a092553ae397b402952cfbd7f12

    • SHA512

      ada780135d0ca44cb90d5fbf646ac65a6aefb2d97cc9095a82f50a19954fe7dc953090cc79aba5242e696b8aa178fd4134fae4b1f9b242c60afb79376ccdda4d

    • SSDEEP

      768:oxAMnhNNnAcU9atkEayDmxNi+BJF5Pt9OY3X6BOMhF3/J1:oxLJnAcUuJaF6YFD993X6BOMzb

    Score
    10/10
    xwormrattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Xworm family

      xworm

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks