General

  • Target

    d7f084d86011371cd5b8206708fd720f1ace9a2eea4c07cee00d9da3f95c9ae1

  • Size

    51KB

  • Sample

    241121-k6qbgszgkc

  • MD5

    a2ec2f7a3c221f89e8af8241f6cd5662

  • SHA1

    ba5d9ff0c3a8c4b571d85a1ae8fb559fcab89fd3

  • SHA256

    d7f084d86011371cd5b8206708fd720f1ace9a2eea4c07cee00d9da3f95c9ae1

  • SHA512

    e97b01b898bcc28b27079493235dded8f418f676fbb5e89212a502228af32025f8caf8dfdd67a8b8489c2881ca6ff7746917980accd1fd0613bc537e637aa42a

  • SSDEEP

    768:1qTF41hqoKo8sDTO2QhFmp6F5PX9OaSp68OMh/3/C2gOMlAcqDD9ueqwx:1sOhqxdAa28FBF19jSp68OMl6DwJqwx

Malware Config

Extracted

Family

xworm

Version

5.0

C2

127.0.0.1:7772

13.71.91.225:7772

Mutex

Sapr6UBSh6DxjMnP

Attributes
  • Install_directory

    %AppData%

  • install_file

    XClient.exe

  • telegram

    https://api.telegram.org/bot7585343577:AAHgS-QNhULHIXmK3EKIXWuMP2uRNZpJjd8/sendMessage?chat_id=5424396760

aes.plain

Targets

    • Target

      d7f084d86011371cd5b8206708fd720f1ace9a2eea4c07cee00d9da3f95c9ae1

    • Size

      51KB

    • MD5

      a2ec2f7a3c221f89e8af8241f6cd5662

    • SHA1

      ba5d9ff0c3a8c4b571d85a1ae8fb559fcab89fd3

    • SHA256

      d7f084d86011371cd5b8206708fd720f1ace9a2eea4c07cee00d9da3f95c9ae1

    • SHA512

      e97b01b898bcc28b27079493235dded8f418f676fbb5e89212a502228af32025f8caf8dfdd67a8b8489c2881ca6ff7746917980accd1fd0613bc537e637aa42a

    • SSDEEP

      768:1qTF41hqoKo8sDTO2QhFmp6F5PX9OaSp68OMh/3/C2gOMlAcqDD9ueqwx:1sOhqxdAa28FBF19jSp68OMl6DwJqwx

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

    • Xworm family

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v15

Tasks