General

  • Target

    2024-03-14-XWorm-EXE-extracted-from-process-memory-2-of-2.bin

  • Size

    39KB

  • Sample

    241202-tmk24a1nfs

  • MD5

    1f7011058a15bb27d7e1c1233dcbf4a8

  • SHA1

    6bb0901732e570674910aaba16aa5c747085ec4e

  • SHA256

    9a18f0e78cc5c27d1439b2842de6db4c43b8efed7db06dfd700a9becc00ccab7

  • SHA512

    a27af26825dd9d685380c09ed6a6c89602600f1bd2350baeb0226ebc046e341899040dc848d32a7a80ea9114c2ccff6ee1c62ff2e5492eeb9f1b813c3b76abfa

  • SSDEEP

    768:FBxPSWITDj+SYbK4p1l4IHofeFv9WSQO+hRq7V:3x+Cj1lKmFv9WpO+rGV

Score
10/10

Malware Config

Extracted

Family

xworm

Version

5.0

C2

91.134.150.150:7000

Mutex

zF2pXWj2jnO4fKEV

Attributes
  • install_file

    USB.exe

aes.plain

Targets

    • Target

      2024-03-14-XWorm-EXE-extracted-from-process-memory-2-of-2.bin

    • Size

      39KB

    • MD5

      1f7011058a15bb27d7e1c1233dcbf4a8

    • SHA1

      6bb0901732e570674910aaba16aa5c747085ec4e

    • SHA256

      9a18f0e78cc5c27d1439b2842de6db4c43b8efed7db06dfd700a9becc00ccab7

    • SHA512

      a27af26825dd9d685380c09ed6a6c89602600f1bd2350baeb0226ebc046e341899040dc848d32a7a80ea9114c2ccff6ee1c62ff2e5492eeb9f1b813c3b76abfa

    • SSDEEP

      768:FBxPSWITDj+SYbK4p1l4IHofeFv9WSQO+hRq7V:3x+Cj1lKmFv9WpO+rGV

    Score
    10/10
    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

    • Xworm family

MITRE ATT&CK Matrix

Tasks