Overview

overview

10

Static

static

10

74ad850a82...63.exe

windows7-x64

10

74ad850a82...63.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    74ad850a826557d15f97d1a6d25ed6b95d131f246480e82b287f4d8f42f9ab63

  • Size

    64KB

  • Sample

    241111-nv8kgayfll

  • MD5

    5f9abf5fdc7ea0787b7d0028a54a674a

  • SHA1

    76993b04e468129450d5107f04b42d1a08cf9e54

  • SHA256

    74ad850a826557d15f97d1a6d25ed6b95d131f246480e82b287f4d8f42f9ab63

  • SHA512

    1a12c64bfd57b083b377aa0f1f5a8f4cd28a1c6e96009f5aaa5a3a29e6161c5017a846a2c3e87480324631c892dfa0f92264182ff65612231334bb358aed0247

  • SSDEEP

    1536:KdoJ9PiMgbgEk5f3QHdsH6hOrbZ+DX/qLH6ghJ8D1owz5Oh/7:M5U19sdsahOrbZeSEDaw1Oh/7

Score
10/10
xwormrattrojan

Malware Config

Extracted

Family

xworm

Version

3.0

Attributes
  • Install_directory

    %Temp%

  • install_file

    USB.exe

  • pastebin_url

    https://pastebin.com/raw/aN42btSy

  • telegram

    https://api.telegram.org/bot6705170780:AAFLOXrnAOxDhNu3tap1IE119Otvgco_CbY/sendMessage?chat_id=6084847021

Targets

    • Target

      74ad850a826557d15f97d1a6d25ed6b95d131f246480e82b287f4d8f42f9ab63

    • Size

      64KB

    • MD5

      5f9abf5fdc7ea0787b7d0028a54a674a

    • SHA1

      76993b04e468129450d5107f04b42d1a08cf9e54

    • SHA256

      74ad850a826557d15f97d1a6d25ed6b95d131f246480e82b287f4d8f42f9ab63

    • SHA512

      1a12c64bfd57b083b377aa0f1f5a8f4cd28a1c6e96009f5aaa5a3a29e6161c5017a846a2c3e87480324631c892dfa0f92264182ff65612231334bb358aed0247

    • SSDEEP

      1536:KdoJ9PiMgbgEk5f3QHdsH6hOrbZ+DX/qLH6ghJ8D1owz5Oh/7:M5U19sdsahOrbZeSEDaw1Oh/7

    Score
    10/10
    xwormrattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Xworm family

      xworm

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks