Resubmissions

22-01-2025 15:50

250122-s99tasvlcp 10

22-01-2025 15:46

250122-s7peksvkbr 10

22-01-2025 15:45

250122-s7aanatkgx 10

22-01-2025 14:49

250122-r7c6wa1ncx 10

General

  • Target

    TDMenu_x64.exe

  • Size

    6.4MB

  • Sample

    250122-s7aanatkgx

  • MD5

    3f9d8993daa6e07221f9a12eaa011ca6

  • SHA1

    a33290d94fb3bba06337b7b847d971b1a8fd6110

  • SHA256

    109bf7761442498abd03f972c2b315b6ea8727a79ed35e7e75a90e6d1e4b7f79

  • SHA512

    ffb917e3a01e72b5cec0c8ff41328bac3840c6be0dcb05a58513a3f77a32c2280fc6881109725ba931b31809fbb0abb83bdacd9ec8022ea8a49d6476ca2177c0

  • SSDEEP

    98304:S/STPMYacPcyyc7Ht40MV+9eN+jCxf8/kbqEVgUmSr7CqnfMwd+mJbKc1rm7cNAH:S9xcPj9Hy0MWGxk/kWEu72t+mKlPDT

Score
10/10

Malware Config

Extracted

Family

xworm

C2

23.27.201.57:7000

Attributes
  • Install_directory

    %ProgramData%

  • install_file

    DirectX End-User Runtime.exe

Targets

    • Target

      TDMenu_x64.exe

    • Size

      6.4MB

    • MD5

      3f9d8993daa6e07221f9a12eaa011ca6

    • SHA1

      a33290d94fb3bba06337b7b847d971b1a8fd6110

    • SHA256

      109bf7761442498abd03f972c2b315b6ea8727a79ed35e7e75a90e6d1e4b7f79

    • SHA512

      ffb917e3a01e72b5cec0c8ff41328bac3840c6be0dcb05a58513a3f77a32c2280fc6881109725ba931b31809fbb0abb83bdacd9ec8022ea8a49d6476ca2177c0

    • SSDEEP

      98304:S/STPMYacPcyyc7Ht40MV+9eN+jCxf8/kbqEVgUmSr7CqnfMwd+mJbKc1rm7cNAH:S9xcPj9Hy0MWGxk/kWEu72t+mKlPDT

    Score
    10/10
    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

    • Xworm family

    • Executes dropped EXE

MITRE ATT&CK Enterprise v15

Tasks