Overview

overview

10

Static

static

7

XwormLoader.exe

windows7-x64

10

XwormLoader.exe

windows10-2004-x64

10

XwormLoader.exe

windows10-ltsc 2021-x64

10

XwormLoader.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    XwormLoader.exe

  • Size

    7.9MB

  • Sample

    241117-vh5rdatmby

  • MD5

    5b757c6d0af650a77ba1bf7edea18b36

  • SHA1

    c2ee4e12ff4b70511dbcab25dbf8b0d45f2d52b3

  • SHA256

    c2a9fefda9159dd2712510c1c9077a1885d0ebc45251285dad95ba7184b98856

  • SHA512

    93ca04887c63c3a0a4a5d42c48d0f4f7cc7fe7f6dad4dd45136ac048639d2edab66a2d2459779b9a2a075fa8981ea40567b34e5ed0535c1deecfe5e838385960

  • SSDEEP

    196608:T7b4C6XrL5HfZBEhl3xZi5OslC9+PWbXooVl41u1mMFsr5:T7yvRZBEP3xZi5Oso+PWbXooL4Sa

Score
10/10
xwormexecutionrattrojan

Malware Config

Targets

    • Target

      XwormLoader.exe

    • Size

      7.9MB

    • MD5

      5b757c6d0af650a77ba1bf7edea18b36

    • SHA1

      c2ee4e12ff4b70511dbcab25dbf8b0d45f2d52b3

    • SHA256

      c2a9fefda9159dd2712510c1c9077a1885d0ebc45251285dad95ba7184b98856

    • SHA512

      93ca04887c63c3a0a4a5d42c48d0f4f7cc7fe7f6dad4dd45136ac048639d2edab66a2d2459779b9a2a075fa8981ea40567b34e5ed0535c1deecfe5e838385960

    • SSDEEP

      196608:T7b4C6XrL5HfZBEhl3xZi5OslC9+PWbXooVl41u1mMFsr5:T7yvRZBEP3xZi5Oso+PWbXooL4Sa

    Score
    10/10
    xwormexecutionrattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Xworm family

      xworm

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • .NET Reactor proctector

      Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    behavioral1behavioral2behavioral3behavioral4

MITRE ATT&CK Enterprise v15

Tasks