Overview

overview

10

Static

static

10

Xworm.rar

windows7-x64

Xworm.rar

windows10-2004-x64

Xworm.rar

android-9-x86

Xworm.rar

android-10-x64

Xworm.rar

android-11-x64

Xworm.rar

macos-10.15-amd64

Xworm.rar

ubuntu-18.04-amd64

Xworm.rar

debian-9-armhf

Xworm.rar

debian-9-mips

Xworm.rar

debian-9-mipsel

Resubmissions

13-01-2025 01:02

250113-beamaa1jak 10

10-01-2025 10:16

250110-mat1xatpep 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Xworm.rar

  • Size

    27.4MB

  • Sample

    250113-beamaa1jak

  • MD5

    c727fe539b6be3b11e71183118f4c7f5

  • SHA1

    1cfedea0294f400b0aea7a8bd60529f2a2ae9026

  • SHA256

    3cca5bd72a29bcd3621db5307142564ab6d2ecfc909d896d39f356ef3e2d37c0

  • SHA512

    22386194913d431d23f94949f85654614b61e0fa0a354eee095fa92b1a65544c3c58726213ef14b0f5dcef5fb11a9a8efac6a2833882cc129631bb186d89d902

  • SSDEEP

    786432:UyCHkGGilFCuOb9shP7CR2UMAK8tM33TdsAE9V:sYE7cCAK8tY3TJE/

Score
10/10
stormkittyxredxwormandroidlinuxmacos

Malware Config

Extracted

Family

xworm

Version

5.0

C2

45.141.26.134:7000

Mutex

CcojtGUool4u0Nw2

Attributes
  • Install_directory

    %Userprofile%

  • install_file

    svchost.exe

aes.plain

Extracted

Family

xred

C2

xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Targets

MITRE ATT&CK Matrix

Tasks