Overview

overview

10

Static

static

3

Crypted.exe

windows7-x64

5

Crypted.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Crypted.Exe

  • Size

    294KB

  • Sample

    250119-3zlzla1phw

  • MD5

    6be3a630099930af4aa9dc65e98ec3d8

  • SHA1

    145c029176a6b3bdef2b9a2cfa5741f4ee6a5422

  • SHA256

    eb6e34558fb8179f339e1a2e05b0e83a1c28f5621e75840507ad4c4fb6b5ac83

  • SHA512

    c2578257c5b64c4dc7d67b2dafff7926c0caeb017bd9482c7b46fbdc7a14e1082bd52ff77c2422360b65f7830ef142a66d8f72c211b45f5250da0aa13612501e

  • SSDEEP

    6144:IbN7cybLr9agW1XMmOji5Qd1+D+sQjzpVrm:IB7zbLrRWajd19nnpVq

Score
10/10
xwormdiscoveryrattrojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

robert2day-54368.portmap.host:54368

Mutex

8a7Sje0orHTMqu0F

Attributes
  • install_file

    USB.exe

  • telegram

    https://api.telegram.org/bot8029262913:AAFSJbcefH3RuCQr6aHzYrVOAKTweiR_OvoM/sendMessage?chat_id=5479981438

aes.plain

Targets

    • Target

      Crypted.Exe

    • Size

      294KB

    • MD5

      6be3a630099930af4aa9dc65e98ec3d8

    • SHA1

      145c029176a6b3bdef2b9a2cfa5741f4ee6a5422

    • SHA256

      eb6e34558fb8179f339e1a2e05b0e83a1c28f5621e75840507ad4c4fb6b5ac83

    • SHA512

      c2578257c5b64c4dc7d67b2dafff7926c0caeb017bd9482c7b46fbdc7a14e1082bd52ff77c2422360b65f7830ef142a66d8f72c211b45f5250da0aa13612501e

    • SSDEEP

      6144:IbN7cybLr9agW1XMmOji5Qd1+D+sQjzpVrm:IB7zbLrRWajd19nnpVq

    Score
    10/10
    discoveryxwormrattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Xworm family

      xworm

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks