Overview

overview

10

Static

static

1

New Text Document.txt

windows10-ltsc 2021-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    New Text Document.txt

  • Size

    261B

  • Sample

    250124-h3fxjaxqcp

  • MD5

    b7d1dea96fc88cf58391d928a3558e32

  • SHA1

    c4a5be1b46c579c8405006c7da0b672181e90403

  • SHA256

    7d83f37893fa8a17d42fe040878b30e1015286849931be05c60c908c3759d576

  • SHA512

    08b08f2bf4f735c673f550c432badcf42e625e240971b78b8dc5d5c43f48076196aac44926882e4e0483f122a32c6633b6d57467e05ffe30fd5ee4190c351572

Score
10/10
xwormexecutionrattrojan

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

https://github.com/AmjadBalls/TEST/raw/refs/heads/main/Discord.exe
exe.dropper

https://github.com/AmjadBalls/TEST/raw/refs/heads/main/GoogleChrome.exe
exe.dropper

https://github.com/AmjadBalls/TEST/raw/refs/heads/main/explorer.exe
exe.dropper

https://github.com/AmjadBalls/TEST/raw/refs/heads/main/svchost.exe

Extracted

Family

xworm

C2

147.185.221.24:35724

Attributes
  • Install_directory

    %ProgramData%

  • install_file

    USB.exe

Targets

    • Target

      New Text Document.txt

    • Size

      261B

    • MD5

      b7d1dea96fc88cf58391d928a3558e32

    • SHA1

      c4a5be1b46c579c8405006c7da0b672181e90403

    • SHA256

      7d83f37893fa8a17d42fe040878b30e1015286849931be05c60c908c3759d576

    • SHA512

      08b08f2bf4f735c673f550c432badcf42e625e240971b78b8dc5d5c43f48076196aac44926882e4e0483f122a32c6633b6d57467e05ffe30fd5ee4190c351572

    Score
    10/10
    xwormexecutionrattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Xworm family

      xworm

    • Command and Scripting Interpreter: PowerShell

      Start PowerShell.

      execution

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks