xworm

General

Target

FALLO ACCIÓN DE TUTELA 2023-250 JDO 02 CMES.zip
Size

6KB
Sample

241114-tvn4qazrhy
MD5

298e4d9405ddb8493d6b7beff47b1f40
SHA1

337ffe4c1032276b6ac4997cdb8e549ad3bed5c3
SHA256

0cf292ac0cdac7a8a901ca29ad6db6782fc49ad1b29508c22c1c77c9c823434b
SHA512

d91f2c3dcd115dd6e25aff3d25243571b45a1d80eaf80169c86fba8a54b3c80b00741100711c103d21ab119cce9f115384759183c0a4eb289706d6a5f1a28644
SSDEEP

192:cerAWJ85Qm+CgkpP01O598cF72VzEb6BY:cgxwR+OqU38cwVo6u

Score

10^/10

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://3105.filemail.com/api/file/get?filekey=mL2_TnIGKQqocB6zLvcvN68Tq_FpfC4Gh8VCgsz_iDhqU3UX_H_oxv3cUysOULpM&pk_vid=fd4f614bb209c62c1730851470a0904f

exe.dropper

https://3105.filemail.com/api/file/get?filekey=mL2_TnIGKQqocB6zLvcvN68Tq_FpfC4Gh8VCgsz_iDhqU3UX_H_oxv3cUysOULpM&pk_vid=fd4f614bb209c62c1730851470a0904f

Targets

- Target
  
  FALLO ACCIÓN DE TUTELA 2023-250 JDO 02 CMES.zip
- Size
  
  6KB
- MD5
  
  298e4d9405ddb8493d6b7beff47b1f40
- SHA1
  
  337ffe4c1032276b6ac4997cdb8e549ad3bed5c3
- SHA256
  
  0cf292ac0cdac7a8a901ca29ad6db6782fc49ad1b29508c22c1c77c9c823434b
- SHA512
  
  d91f2c3dcd115dd6e25aff3d25243571b45a1d80eaf80169c86fba8a54b3c80b00741100711c103d21ab119cce9f115384759183c0a4eb289706d6a5f1a28644
- SSDEEP
  
  192:cerAWJ85Qm+CgkpP01O598cF72VzEb6BY:cgxwR+OqU38cwVo6u
Score

10^/10

xworm execution rat trojan
- Detect Xworm Payload
- Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Xworm family
  xworm
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Drops startup file
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detect Xworm Payload

Xworm family

Blocklisted process makes network request

Command and Scripting Interpreter: PowerShell

Drops startup file

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2