Overview

overview

10

Static

static

10

5f4f1ac42b...b2.exe

windows7-x64

10

5f4f1ac42b...b2.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5f4f1ac42bdb24c2cf818a1e6f1b35c8163341b86f617b5e2f6c3a64f8a013b2

  • Size

    32KB

  • Sample

    250125-awcyaswpfz

  • MD5

    6861f2511e01bf8cc6a7c1602ecce463

  • SHA1

    795b2047772c3525374c2f31285c537023684b75

  • SHA256

    5f4f1ac42bdb24c2cf818a1e6f1b35c8163341b86f617b5e2f6c3a64f8a013b2

  • SHA512

    35e764302bf2a285102fbc3bba8a6a6acf07286e550aeae8f984345e483ef51482e587e373e681e39a3ddaa8f2ac265e10ef82e2ce06b6009f046fa9af99df66

  • SSDEEP

    768:pVa+vNtg+PB93Tw49FzVFE9jiHOjhcbR:BvNtgw93U49HFE9jcOjql

Score
10/10
xwormrattrojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

127.0.0.1:7000

Mutex

ksJXgVv5zjnRbsOt

Attributes
  • install_file

    USB.exe

aes.plain

Targets

    • Target

      5f4f1ac42bdb24c2cf818a1e6f1b35c8163341b86f617b5e2f6c3a64f8a013b2

    • Size

      32KB

    • MD5

      6861f2511e01bf8cc6a7c1602ecce463

    • SHA1

      795b2047772c3525374c2f31285c537023684b75

    • SHA256

      5f4f1ac42bdb24c2cf818a1e6f1b35c8163341b86f617b5e2f6c3a64f8a013b2

    • SHA512

      35e764302bf2a285102fbc3bba8a6a6acf07286e550aeae8f984345e483ef51482e587e373e681e39a3ddaa8f2ac265e10ef82e2ce06b6009f046fa9af99df66

    • SSDEEP

      768:pVa+vNtg+PB93Tw49FzVFE9jiHOjhcbR:BvNtgw93U49HFE9jcOjql

    Score
    10/10
    xwormrattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Xworm family

      xworm
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks