General

  • Target

    b628182a47f7fd2c29c17862402dd36811524b58538996a2523d59920ffb6de8

  • Size

    36KB

  • Sample

    241202-vsk5qatnbt

  • MD5

    1be858f3a11289427e9f8cf42093ef8f

  • SHA1

    36eebd971a6f3961287106e1c590c4d498dea943

  • SHA256

    b628182a47f7fd2c29c17862402dd36811524b58538996a2523d59920ffb6de8

  • SHA512

    44ba49df8ca1bff49ee24d1c178939f3b8ec6827612c77e4306f0d12360649e7546c13d8199962b494b44f4fbdcb6bee006798e9a8ddb6735ec58db4335b52d2

  • SSDEEP

    768:2GLtt3QI2/yQJVZsNeo8icHS13bFb9Yt2OMhXQnv5:2Ab3QI2/yQBYeNicHS1LFb9YIOMJa5

Score
10/10

Malware Config

Extracted

Family

xworm

Version

5.0

C2

dcxwq1.duckdns.org:7000

Mutex

dsOejpCEgmpWzw8P

Attributes
  • install_file

    USB.exe

aes.plain

Targets

    • Target

      b628182a47f7fd2c29c17862402dd36811524b58538996a2523d59920ffb6de8

    • Size

      36KB

    • MD5

      1be858f3a11289427e9f8cf42093ef8f

    • SHA1

      36eebd971a6f3961287106e1c590c4d498dea943

    • SHA256

      b628182a47f7fd2c29c17862402dd36811524b58538996a2523d59920ffb6de8

    • SHA512

      44ba49df8ca1bff49ee24d1c178939f3b8ec6827612c77e4306f0d12360649e7546c13d8199962b494b44f4fbdcb6bee006798e9a8ddb6735ec58db4335b52d2

    • SSDEEP

      768:2GLtt3QI2/yQJVZsNeo8icHS13bFb9Yt2OMhXQnv5:2Ab3QI2/yQBYeNicHS1LFb9YIOMJa5

    Score
    10/10
    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

    • Xworm family

MITRE ATT&CK Matrix

Tasks