Overview

overview

10

Static

static

10

c2759e9080...0N.exe

windows7-x64

10

c2759e9080...0N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c2759e90808a07ea6bb89e5de34db0b3d31ecf31cc7f5ccc9fca988b1991a230N.exe

  • Size

    35KB

  • Sample

    241202-r3xpqatnaq

  • MD5

    a5b439849ceb3fb3a57f42db36171640

  • SHA1

    895b5f4a8235aec670123a8f90438f27341c112d

  • SHA256

    c2759e90808a07ea6bb89e5de34db0b3d31ecf31cc7f5ccc9fca988b1991a230

  • SHA512

    2afcc56e2dae0add1a38d7fdff5b2c168ce9dbd89e06731895bf29d61ebcf887933b2245342901cb65a416ff60bf8a4c77cb930b89ed5bdf7946254d5b18c253

  • SSDEEP

    768:Tf7+g2FOV4d6eW3xLespNivYF+9YEOjhN/1+d:TfC1OVXeWBLvzigF+9YEOjLN+d

Score
10/10
xwormpersistencerattrojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

46.150.81.213:7000

Mutex

6xOBTSnAE6nzpH2N

Attributes
  • Install_directory

    %AppData%

  • install_file

    X.exe

  • telegram

    https://api.telegram.org/bot5730542754:AAGcXuKiNtiWQJAJnjgM64USDcYhKvCiXOE/sendMessage?chat_id=954433903

aes.plain

Targets

    • Target

      c2759e90808a07ea6bb89e5de34db0b3d31ecf31cc7f5ccc9fca988b1991a230N.exe

    • Size

      35KB

    • MD5

      a5b439849ceb3fb3a57f42db36171640

    • SHA1

      895b5f4a8235aec670123a8f90438f27341c112d

    • SHA256

      c2759e90808a07ea6bb89e5de34db0b3d31ecf31cc7f5ccc9fca988b1991a230

    • SHA512

      2afcc56e2dae0add1a38d7fdff5b2c168ce9dbd89e06731895bf29d61ebcf887933b2245342901cb65a416ff60bf8a4c77cb930b89ed5bdf7946254d5b18c253

    • SSDEEP

      768:Tf7+g2FOV4d6eW3xLespNivYF+9YEOjhN/1+d:TfC1OVXeWBLvzigF+9YEOjLN+d

    Score
    10/10
    xwormpersistencerattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Xworm family

      xworm

    • Drops startup file

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks