General

  • Target

    PySilonObfuscator.exe

  • Size

    68KB

  • Sample

    241111-wybznswpeq

  • MD5

    08662f2242b71e0acb3625651c7df3a6

  • SHA1

    6853179e1966109f3ebb935433c03da9c6c182ee

  • SHA256

    38e621069881b6e5b08702d6ea1986617f0c0b06bee31689832a9451114dab07

  • SHA512

    2c6696a23d4a71b62549db6e9178233f9a01544cb9dad2b65d015cd7a9dddacff5f9551dc1376745ef278239b9385f50dcd5337d3528db2154987d0723ccd75d

  • SSDEEP

    1536:r/AZVZ4/roxZKJWqdFDkbb+uIZAL4sxn8O5Jvfy+wCqonw:r/Ani/roLqdNkbbYAMs2O5Jqpon

Score
10/10

Malware Config

Extracted

Family

xworm

C2

127.0.0.1:7583

Attributes
  • install_file

    USB.exe

Targets

    • Target

      PySilonObfuscator.exe

    • Size

      68KB

    • MD5

      08662f2242b71e0acb3625651c7df3a6

    • SHA1

      6853179e1966109f3ebb935433c03da9c6c182ee

    • SHA256

      38e621069881b6e5b08702d6ea1986617f0c0b06bee31689832a9451114dab07

    • SHA512

      2c6696a23d4a71b62549db6e9178233f9a01544cb9dad2b65d015cd7a9dddacff5f9551dc1376745ef278239b9385f50dcd5337d3528db2154987d0723ccd75d

    • SSDEEP

      1536:r/AZVZ4/roxZKJWqdFDkbb+uIZAL4sxn8O5Jvfy+wCqonw:r/Ani/roLqdNkbbYAMs2O5Jqpon

    Score
    10/10
    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

    • Xworm family

MITRE ATT&CK Matrix

Tasks