Overview

overview

10

Static

static

7

b59f8aa345...af.exe

windows7-x64

10

b59f8aa345...af.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b59f8aa345438bdb58e6939f7d127cdcc44e1f9e907cf3bdf6aae86df39a93af

  • Size

    481KB

  • Sample

    241204-cdg6eawjb1

  • MD5

    8c0001c9778f78612be047c759d5e75e

  • SHA1

    7772e9963eadb4d6063260dbb301f229c04e34f7

  • SHA256

    b59f8aa345438bdb58e6939f7d127cdcc44e1f9e907cf3bdf6aae86df39a93af

  • SHA512

    a36ef7475d9e723fdab42d91684d1ad868bbac6a4d528666f7ccb0c8dc819d4074e8ed34b47384b33072773c3a8bea89880de56362abc60a8eb37fd0da807325

  • SSDEEP

    12288:TRpwAsn4WQldetfqu0R9nTnFEVoQd8jc7Ke:dpwAsn47luq9jFivg

Score
10/10
xwormrattrojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

outside-probe.gl.at.ply.gg:15581

Mutex

IZyQaNq9K1TMZV9t

Attributes
  • install_file

    USB.exe

aes.plain

Targets

    • Target

      b59f8aa345438bdb58e6939f7d127cdcc44e1f9e907cf3bdf6aae86df39a93af

    • Size

      481KB

    • MD5

      8c0001c9778f78612be047c759d5e75e

    • SHA1

      7772e9963eadb4d6063260dbb301f229c04e34f7

    • SHA256

      b59f8aa345438bdb58e6939f7d127cdcc44e1f9e907cf3bdf6aae86df39a93af

    • SHA512

      a36ef7475d9e723fdab42d91684d1ad868bbac6a4d528666f7ccb0c8dc819d4074e8ed34b47384b33072773c3a8bea89880de56362abc60a8eb37fd0da807325

    • SSDEEP

      12288:TRpwAsn4WQldetfqu0R9nTnFEVoQd8jc7Ke:dpwAsn47luq9jFivg

    Score
    10/10
    xwormrattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Xworm family

      xworm
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks