Overview

overview

10

Static

static

5

fa526b6b6f...eN.exe

windows7-x64

10

fa526b6b6f...eN.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fa526b6b6f9cfd9ce9772bb128b924d829b9193e6c1a4f4cd65284c563b1944eN.exe

  • Size

    1.1MB

  • Sample

    250121-qwh3bawke1

  • MD5

    d9dbf8790fda74b66d00d6ab40fcc370

  • SHA1

    671d46b5408dc92b1c0502b1a758b74151408ae9

  • SHA256

    fa526b6b6f9cfd9ce9772bb128b924d829b9193e6c1a4f4cd65284c563b1944e

  • SHA512

    0afbfe4b928a2940d641f18f59f5333b7bd1dda0f61a49d3340cc5e84795ea48feeb3ef934f02dbd24e05b557972e8f3ff5fc7dd42ff020a2a74f44956b8a4a7

  • SSDEEP

    24576:sqDEvCTbMWu7rQYlBQcBiT6rprG8aZ0tmEbmZp:sTvC/MTQYxsWR7aZ9eo

Score
10/10
xwormdiscoveryrattrojan

Malware Config

Targets

    • Target

      fa526b6b6f9cfd9ce9772bb128b924d829b9193e6c1a4f4cd65284c563b1944eN.exe

    • Size

      1.1MB

    • MD5

      d9dbf8790fda74b66d00d6ab40fcc370

    • SHA1

      671d46b5408dc92b1c0502b1a758b74151408ae9

    • SHA256

      fa526b6b6f9cfd9ce9772bb128b924d829b9193e6c1a4f4cd65284c563b1944e

    • SHA512

      0afbfe4b928a2940d641f18f59f5333b7bd1dda0f61a49d3340cc5e84795ea48feeb3ef934f02dbd24e05b557972e8f3ff5fc7dd42ff020a2a74f44956b8a4a7

    • SSDEEP

      24576:sqDEvCTbMWu7rQYlBQcBiT6rprG8aZ0tmEbmZp:sTvC/MTQYxsWR7aZ9eo

    Score
    10/10
    xwormdiscoveryrattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Xworm family

      xworm

    • .NET Reactor proctector

      Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks