Overview

overview

10

Static

static

10

04cfe85ad9...1f.exe

windows7-x64

10

04cfe85ad9...1f.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f869f9d64a8a01aff088f8c830a477dc.bin

  • Size

    16KB

  • Sample

    241119-cd7q3atneq

  • MD5

    01456ca94f373bf8aba111f13fd6f9a3

  • SHA1

    e17567c7fac8c466e08ff98a963f79d5a5010443

  • SHA256

    821539854b93ca25f87b28ef07c457fab760661bab30cb4e37f5349dd02edad9

  • SHA512

    1e8cd17629e9060a89ac7a39b2e53ad743854c625dedd72c66ce9620d0ee5c75394583604345d4596ecb8b07c60acfc6b6cd11a20ea7711eea0deee119974900

  • SSDEEP

    384:088dHLoX/h2/tyj4lWhzgfsUkaNVfMgZRNKnnMOG:YEPQtVlWhzNvaNFPKMOG

Score
10/10
xwormrattrojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

sep-framing.gl.at.ply.gg:61526

Mutex

wCIHQbYCz8ryLWwh

Attributes
  • install_file

    USB.exe

aes.plain

Targets

    • Target

      04cfe85ad9f84a7bb65c39ed40e209fdd61f3a3cb52d0606a9fc41f780a2ba1f.exe

    • Size

      33KB

    • MD5

      f869f9d64a8a01aff088f8c830a477dc

    • SHA1

      0e8af0081201e0d423abc29ae6f2cd948c12ba97

    • SHA256

      04cfe85ad9f84a7bb65c39ed40e209fdd61f3a3cb52d0606a9fc41f780a2ba1f

    • SHA512

      0da21ecb4896f716b1fb3b3e8813eb268aabd84f1e51f29c24fc6b8349ccfbd377d957828b437882d5ef65c654001f25a65259777ecd18980cdd0116afde876c

    • SSDEEP

      384:Cl8UlK/V9FoBZ9aZV0NLx7o92lKZaJZvf/95ApkFy7BLT/OZwpGmTv99IkcisOHh:qO/VMOGxwgJZvn9dFyJ9FoOjh4Jy

    Score
    10/10
    xwormrattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Xworm family

      xworm
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks