Overview

overview

10

Static

static

10

XWorm_V5.6...rm.exe

windows7-x64

10

XWorm_V5.6...rm.exe

windows10-2004-x64

10

XWorm_V5.6...ox.dll

windows7-x64

1

XWorm_V5.6...ox.dll

windows10-2004-x64

1

XWorm_V5.6...er.bat

windows7-x64

1

XWorm_V5.6...er.bat

windows10-2004-x64

1

XWorm_V5.6...re.dll

windows7-x64

1

XWorm_V5.6...re.dll

windows10-2004-x64

1

XWorm_V5.6...ms.dll

windows7-x64

1

XWorm_V5.6...ms.dll

windows10-2004-x64

1

XWorm_V5.6...I2.dll

windows7-x64

1

XWorm_V5.6...I2.dll

windows10-2004-x64

1

XWorm_V5.6...or.dll

windows7-x64

1

XWorm_V5.6...or.dll

windows10-2004-x64

1

XWorm_V5.6...io.dll

windows7-x64

1

XWorm_V5.6...io.dll

windows10-2004-x64

1

XWorm_V5.6...on.dll

windows7-x64

1

XWorm_V5.6...on.dll

windows10-2004-x64

1

XWorm_V5.6...ws.dll

windows7-x64

1

XWorm_V5.6...ws.dll

windows10-2004-x64

1

XWorm_V5.6...at.dll

windows7-x64

1

XWorm_V5.6...at.dll

windows10-2004-x64

1

XWorm_V5.6...um.dll

windows7-x64

1

XWorm_V5.6...um.dll

windows10-2004-x64

1

XWorm_V5.6...rd.dll

windows7-x64

1

XWorm_V5.6...rd.dll

windows10-2004-x64

1

XWorm_V5.6...ss.dll

windows7-x64

1

XWorm_V5.6...ss.dll

windows10-2004-x64

1

XWorm_V5.6...er.dll

windows7-x64

1

XWorm_V5.6...er.dll

windows10-2004-x64

1

XWorm_V5.6...er.dll

windows7-x64

1

XWorm_V5.6...er.dll

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    XWorm_V5.61.rar

  • Size

    21.3MB

  • MD5

    644d9061897fdd38b6c0732b8cb69be3

  • SHA1

    153a1359ea82878d4ecda8ab132faf778d4c8148

  • SHA256

    2caf7c96d8891b799082f6406657817ec7cffd82e54d5a44d9d4f6b82ff8ea32

  • SHA512

    d9a350d4df1174095912811787a8f93f9bac56820d09024964175684f64cd04799b1cc2b47a2253e95b2f3ac7751712b22c5be13bab1c617272dcab42f21cfd7

  • SSDEEP

    393216:jyaudJe35+5JgXIIZR866vU4pMKi5HfApb/PpvQAm2qF3Eozm4pWL0avp:jyVdo35cJg4IZS66lSb5/AptHwE8FWHB

Score
10/10
xwormstormkittyxred

Malware Config

Extracted

Family

xworm

C2

simply-exotic.gl.at.ply.gg:27183

Attributes
  • Install_directory

    %Temp%

  • install_file

    Windows.exe

Extracted

Family

xred

C2

xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Signatures

  • Contains code to disable Windows Defender 1 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detect Xworm Payload 3 IoCs
  • StormKitty payload 1 IoCs
  • Stormkitty family
    stormkitty
  • Xred family
    xred
  • Xworm family
    xworm
  • Unsigned PE 47 IoCs

    Checks for missing Authenticode signature.

Files

  • XWorm_V5.61.rar
    .rar
  • XWorm_V5.6/XWorm V5.6/._cache_Xworm.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • XWorm_V5.6/XWorm V5.6/Background.png
    .png
  • XWorm_V5.6/XWorm V5.6/FastColoredTextBox.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • XWorm_V5.6/XWorm V5.6/Fixer.bat
  • XWorm_V5.6/XWorm V5.6/GMap.NET.Core.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • XWorm_V5.6/XWorm V5.6/GMap.NET.WindowsForms.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • XWorm_V5.6/XWorm V5.6/GeoIP.dat
  • XWorm_V5.6/XWorm V5.6/Guna.UI2.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • XWorm_V5.6/XWorm V5.6/IconExtractor.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • XWorm_V5.6/XWorm V5.6/Icons/icon (1).ico
  • XWorm_V5.6/XWorm V5.6/Icons/icon (10).ico
  • XWorm_V5.6/XWorm V5.6/Icons/icon (11).ico
  • XWorm_V5.6/XWorm V5.6/Icons/icon (12).ico
  • XWorm_V5.6/XWorm V5.6/Icons/icon (13).ico
  • XWorm_V5.6/XWorm V5.6/Icons/icon (14).ico
  • XWorm_V5.6/XWorm V5.6/Icons/icon (15).ico
  • XWorm_V5.6/XWorm V5.6/Icons/icon (16).ico
  • XWorm_V5.6/XWorm V5.6/Icons/icon (17).ico
  • XWorm_V5.6/XWorm V5.6/Icons/icon (2).ico
  • XWorm_V5.6/XWorm V5.6/Icons/icon (3).ico
  • XWorm_V5.6/XWorm V5.6/Icons/icon (4).ico
  • XWorm_V5.6/XWorm V5.6/Icons/icon (5).ico
  • XWorm_V5.6/XWorm V5.6/Icons/icon (6).ico
  • XWorm_V5.6/XWorm V5.6/Icons/icon (7).ico
  • XWorm_V5.6/XWorm V5.6/Icons/icon (8).ico
  • XWorm_V5.6/XWorm V5.6/Icons/icon (9).ico
  • XWorm_V5.6/XWorm V5.6/NAudio.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • XWorm_V5.6/XWorm V5.6/Newtonsoft.Json.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • XWorm_V5.6/XWorm V5.6/Plugins/ActiveWindows.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • XWorm_V5.6/XWorm V5.6/Plugins/Chat.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • XWorm_V5.6/XWorm V5.6/Plugins/Chromium.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • XWorm_V5.6/XWorm V5.6/Plugins/Clipboard.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • XWorm_V5.6/XWorm V5.6/Plugins/Cmstp-Bypass.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • XWorm_V5.6/XWorm V5.6/Plugins/FileManager.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • XWorm_V5.6/XWorm V5.6/Plugins/FilesSearcher.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • XWorm_V5.6/XWorm V5.6/Plugins/HBrowser.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • XWorm_V5.6/XWorm V5.6/Plugins/HRDP.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • XWorm_V5.6/XWorm V5.6/Plugins/HVNC.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • XWorm_V5.6/XWorm V5.6/Plugins/HVNCMemory.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • XWorm_V5.6/XWorm V5.6/Plugins/HiddenApps.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • XWorm_V5.6/XWorm V5.6/Plugins/Informations.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • XWorm_V5.6/XWorm V5.6/Plugins/Keylogger.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • XWorm_V5.6/XWorm V5.6/Plugins/Maps.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • XWorm_V5.6/XWorm V5.6/Plugins/MessageBox.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • XWorm_V5.6/XWorm V5.6/Plugins/Microphone.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • XWorm_V5.6/XWorm V5.6/Plugins/Ngrok-Installer.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • XWorm_V5.6/XWorm V5.6/Plugins/Options.dll
    .dll .ps1 windows:4 windows x86 arch:x86 polyglot

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • XWorm_V5.6/XWorm V5.6/Plugins/Pastime.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • XWorm_V5.6/XWorm V5.6/Plugins/Performance.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • XWorm_V5.6/XWorm V5.6/Plugins/ProcessManager.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • XWorm_V5.6/XWorm V5.6/Plugins/Programs.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • XWorm_V5.6/XWorm V5.6/Plugins/Ransomware.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • XWorm_V5.6/XWorm V5.6/Plugins/Recovery.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • XWorm_V5.6/XWorm V5.6/Plugins/Regedit.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • XWorm_V5.6/XWorm V5.6/Plugins/RemoteDesktop.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • XWorm_V5.6/XWorm V5.6/Plugins/ReverseProxy.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • XWorm_V5.6/XWorm V5.6/Plugins/RunPE.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • XWorm_V5.6/XWorm V5.6/Plugins/ServiceManager.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • XWorm_V5.6/XWorm V5.6/Plugins/Shell.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • XWorm_V5.6/XWorm V5.6/Plugins/StartupManager.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • XWorm_V5.6/XWorm V5.6/Plugins/Stealer.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • XWorm_V5.6/XWorm V5.6/Plugins/TCPConnections.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • XWorm_V5.6/XWorm V5.6/Plugins/UACBypass.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • XWorm_V5.6/XWorm V5.6/Plugins/VB.NET Compiler.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • XWorm_V5.6/XWorm V5.6/Plugins/VoiceChat.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • XWorm_V5.6/XWorm V5.6/Plugins/WSound.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • XWorm_V5.6/XWorm V5.6/Plugins/WebCam.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • XWorm_V5.6/XWorm V5.6/RES/U40957361f7481084776e6aedU9f0U1
  • XWorm_V5.6/XWorm V5.6/RES/XWorm.ACT.resources
  • XWorm_V5.6/XWorm V5.6/RES/XWorm.About.resources
  • XWorm_V5.6/XWorm V5.6/RES/XWorm.Builder.resources
  • XWorm_V5.6/XWorm V5.6/RES/XWorm.Chat.resources
  • XWorm_V5.6/XWorm V5.6/RES/XWorm.Clipboard.resources
  • XWorm_V5.6/XWorm V5.6/RES/XWorm.Clipper.resources
  • XWorm_V5.6/XWorm V5.6/RES/XWorm.CustomOpen.resources
  • XWorm_V5.6/XWorm V5.6/RES/XWorm.DDosAttack.resources
  • XWorm_V5.6/XWorm V5.6/RES/XWorm.EditReg.resources
  • XWorm_V5.6/XWorm V5.6/RES/XWorm.FM.resources
  • XWorm_V5.6/XWorm V5.6/RES/XWorm.FilesSearcher.resources
  • XWorm_V5.6/XWorm V5.6/RES/XWorm.Ftp.resources
  • XWorm_V5.6/XWorm V5.6/RES/XWorm.Fun.resources
  • XWorm_V5.6/XWorm V5.6/RES/XWorm.HApps.resources
  • XWorm_V5.6/XWorm V5.6/RES/XWorm.HBrowser.resources
  • XWorm_V5.6/XWorm V5.6/RES/XWorm.HRDP.resources
  • XWorm_V5.6/XWorm V5.6/RES/XWorm.HVNC.resources
  • XWorm_V5.6/XWorm V5.6/RES/XWorm.Hash.resources
  • XWorm_V5.6/XWorm V5.6/RES/XWorm.Hosts.resources
  • XWorm_V5.6/XWorm V5.6/RES/XWorm.INFO.resources
  • XWorm_V5.6/XWorm V5.6/RES/XWorm.Keylogger.resources
  • XWorm_V5.6/XWorm V5.6/RES/XWorm.MBox.resources
  • XWorm_V5.6/XWorm V5.6/RES/XWorm.MIC.resources
  • XWorm_V5.6/XWorm V5.6/RES/XWorm.Main.resources
  • XWorm_V5.6/XWorm V5.6/RES/XWorm.Maps.resources
  • XWorm_V5.6/XWorm V5.6/RES/XWorm.Performance.resources
  • XWorm_V5.6/XWorm V5.6/RES/XWorm.Port.resources
  • XWorm_V5.6/XWorm V5.6/RES/XWorm.ProcessV.resources
  • XWorm_V5.6/XWorm V5.6/RES/XWorm.Programs.resources
  • XWorm_V5.6/XWorm V5.6/RES/XWorm.Proxy.resources
  • XWorm_V5.6/XWorm V5.6/RES/XWorm.Ransomware.resources
  • XWorm_V5.6/XWorm V5.6/RES/XWorm.Registry.resources
  • XWorm_V5.6/XWorm V5.6/RES/XWorm.RemoteDesktop.resources
  • XWorm_V5.6/XWorm V5.6/RES/XWorm.Resources.resources
    .vbs
  • XWorm_V5.6/XWorm V5.6/RES/XWorm.RunPE.resources
  • XWorm_V5.6/XWorm V5.6/RES/XWorm.ServiceManager.resources
  • XWorm_V5.6/XWorm V5.6/RES/XWorm.Shell.resources
  • XWorm_V5.6/XWorm V5.6/RES/XWorm.Sound.resources
  • XWorm_V5.6/XWorm V5.6/RES/XWorm.StartupManager.resources
  • XWorm_V5.6/XWorm V5.6/RES/XWorm.TBotNotify.resources
  • XWorm_V5.6/XWorm V5.6/RES/XWorm.TXT.resources
  • XWorm_V5.6/XWorm V5.6/RES/XWorm.TcpConnectionForm.resources
  • XWorm_V5.6/XWorm V5.6/RES/XWorm.ToolsBox.resources
  • XWorm_V5.6/XWorm V5.6/RES/XWorm.VBCode.resources
  • XWorm_V5.6/XWorm V5.6/RES/XWorm.VoiceChat.resources
  • XWorm_V5.6/XWorm V5.6/RES/XWorm.WebCam.resources
  • XWorm_V5.6/XWorm V5.6/RES/XWorm.ngrok.resources
  • XWorm_V5.6/XWorm V5.6/SimpleObfuscator.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • XWorm_V5.6/XWorm V5.6/Sounds/Chat.wav
  • XWorm_V5.6/XWorm V5.6/Sounds/Intro.wav
  • XWorm_V5.6/XWorm V5.6/Xworm V5.6.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • XWorm_V5.6/XWorm V5.6/Xworm.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections