xworm | hxxps://gofile[.]io/d/VmL8Ux

Analysis

max time kernel
140s
max time network
151s
platform
android_x64
resource
android-x64-arm64-20240624-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
submitted
11-11-2024 20:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://gofile.io/d/VmL8Ux

Score

10^/10

xworm rat trojan

Malware Config

Extracted

Family

xworm

Version

3.1

147.185.221.23:53631

Attributes

Install_directory
%AppData%
install_file
USB.exe

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/files/fstream-5.dat	family_xworm
behavioral2/files/fstream-7.dat	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm
Downloads MZ/PE file

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.android.chrome

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.android.chrome

com.android.chrome
1⤵
- Checks CPU information
- Checks memory information
PID:4305

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

files/dom-0.html

Filesize
32KB

MD5
91a8b3af77a192f15b94dfa33f7c449e

SHA1
5c68b5e571f628df7a6b0211cb79725ef78247af

SHA256
b9c39e37d64f4b637f66e4f6f6ac32638a59ecadfebd2787aba49707b29d9ab5

SHA512
e79603b51ee8771bbf79f00519d0c98627783eb3be43bfff3465022e2915856b99d751677355a13b295146c51bd3cfb50dddcfcb18c9ae12ae038ae5d8ff0e4e

Download Submit
/storage/emulated/0/Download/.com.google.Chrome.Kz4xSC

Filesize
71KB

MD5
f24d23861ae25a5e29ed07ce2edf23ae

SHA1
f44fb5843e43b04f2ab6d372131f780cc4d93e22

SHA256
aeb935a0eed839b1670d762dba8c2ccf443340d4344178070c74be2e666e8e0c

SHA512
4c037c2a699a2349d092686ac18697278d4a52c01752234f4fd3ea2578f8f321557ecd40616ce060fd0ae24411dca9de1f01794cd44a860ed889cbdaf05e2cbe

Download Submit
/storage/emulated/0/Download/.pending-1731963028-Roblox cheat.exe

Filesize
71KB

MD5
74b112aa1d855ee53484487b12848afd

SHA1
0433157de9663e1ca6f7f720370c9318e4e12abf

SHA256
ab46d64893894e6aafb99c0b917b510a2db99c645d16a53d076cb4855b06a752

SHA512
4c9b276b8bc2478508eda2c735cac4fb8cfaaef1c2850d41046136494d233b1807fddf63102f6f19eae89339fc8acfa8b2dd9178f71d1260a318434affade8dc

Download Submit
/storage/emulated/0/Download/.pending-1731963028-Roblox cheat.exe (deleted)

Filesize
520KB

MD5
752bc862e57278b1262c95df5498738e

SHA1
2cdbd4797d070d698d7a76e5a73342ee9887d708

SHA256
6afd8bfd4060ec57570085600c817c868ead06b090ffd7085630c62f25485d1c

SHA512
e261de2834c9fdd778881dbf8b7816e4e2cc0d890c27b4243e8481d23efea93d503587b925c4bcf2ffa09c072ca70e36e2c3b2b883efae3d87f3a822e1a7be8d

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads