Overview

overview

10

Static

static

10

9507a6e7e0...0N.exe

windows7-x64

10

9507a6e7e0...0N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9507a6e7e075169fd41c40af52ed16cd68e1001eca99f3f8e85d03fb09f32ee0N.exe

  • Size

    296KB

  • Sample

    250120-pwsfbazjgs

  • MD5

    27030a3679803a59719b3e3482cf5fd0

  • SHA1

    26cb75e126e4f92a87f27b6d385e5046b82cad85

  • SHA256

    9507a6e7e075169fd41c40af52ed16cd68e1001eca99f3f8e85d03fb09f32ee0

  • SHA512

    8c87a23869dfd309eab513cb0aa0b8dacb0b251a588ef54c8444517a7e71122a5d3fd92af6d9cbf5d81e1f4031154c32fb69ae5831552d52b9494dfe4ccbeecc

  • SSDEEP

    3072:NvNGkHFE9jgOjUDAZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ+ZZZZZZZZZZZZb:5hE92+GIIIIIIIhIIIIIIIIIIIIIIIU

Score
10/10
xwormrattrojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

127.0.0.1:7000

Mutex

tGtdnozfcOQIutZT

Attributes
  • install_file

    USB.exe

aes.plain

Targets

    • Target

      9507a6e7e075169fd41c40af52ed16cd68e1001eca99f3f8e85d03fb09f32ee0N.exe

    • Size

      296KB

    • MD5

      27030a3679803a59719b3e3482cf5fd0

    • SHA1

      26cb75e126e4f92a87f27b6d385e5046b82cad85

    • SHA256

      9507a6e7e075169fd41c40af52ed16cd68e1001eca99f3f8e85d03fb09f32ee0

    • SHA512

      8c87a23869dfd309eab513cb0aa0b8dacb0b251a588ef54c8444517a7e71122a5d3fd92af6d9cbf5d81e1f4031154c32fb69ae5831552d52b9494dfe4ccbeecc

    • SSDEEP

      3072:NvNGkHFE9jgOjUDAZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ+ZZZZZZZZZZZZb:5hE92+GIIIIIIIhIIIIIIIIIIIIIIIU

    Score
    10/10
    xwormrattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Xworm family

      xworm
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks