Overview

overview

10

Static

static

3

comprobant...WM.exe

windows7-x64

10

comprobant...WM.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    85732f49a6cf1d1576cb0f70bbf63803.zip

  • Size

    572KB

  • Sample

    241203-atv14awqam

  • MD5

    85732f49a6cf1d1576cb0f70bbf63803

  • SHA1

    3018d79a8777c63d9c879b0ca482edc5d8000784

  • SHA256

    e2b2337dff35c24590fd331dfb3021f6735dd9384cab0da7153594a34b8afae3

  • SHA512

    2ae5a183dc1a6f9227a2a8c4cf2f3cfa49f590fe325bcbe8bcf3ab97885393219a8e6a2b40211b0247e66bfda7dfe5acf0994d3077471b2136de1ec748c0c9e6

  • SSDEEP

    12288:/9IeKQZyeQ3Sg/fkcpzP1nA90pDaDnpWMFBRL3xeoEwPAYLg://KQAi2c0NRepj3RMoEwlM

Score
10/10
xwormdiscoveryrattrojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

81.161.238.16:1888

Mutex

OrkmMCpHztbQvlRp

Attributes
  • install_file

    USB.exe

aes.plain

Targets

    • Target

      comprobante de pago pdf. NOMINA DEL MES DE NOVIEMBRE GWM.exe

    • Size

      1.4MB

    • MD5

      9a6976b5aa12493660a035722beb4f1a

    • SHA1

      2a10ed32935da1877af8b508a38fa45a04bcdeaa

    • SHA256

      328a18b9c47bd27faf200ae5e68c78e0ff913309a451fe76424ceced516255d3

    • SHA512

      1b8d4220cdfa6c43349f1122cc6682e1c17fceb25757ea52bcaeff14a5ac88655798bfda693f828b9b3859d9a91324433f23310dd3f436dfa2b1a02c9df2e1bd

    • SSDEEP

      24576:dF1LXhUSA0h9W02JhZIdKcytmT9yU4C/kL3HpqlI36r7zAdG7wpEkf2G21FcdQVW:31LhUSAS9R0Z4K9tmT9yU4C/kL3Hpqla

    Score
    10/10
    xwormdiscoveryrattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Xworm family

      xworm

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks