General

  • Target

    Wave.exe

  • Size

    130KB

  • Sample

    250126-e6rawssjhx

  • MD5

    4fa4956530f548fdfc29e7d6ad8d9149

  • SHA1

    3146c36d53fa811d1f2c2fd7edb0c6b88db22593

  • SHA256

    0ffa8670ef82a5a5613da3ef8f7aafb8fb75c254a33981d9a6254ccbce768d46

  • SHA512

    f4410db293bd40516f8dd8fa5f15bc7a0ed276790e5094ca013b48cf847b69595b9efcd7c12f0b68c381b46ed42fc24419c435c10494c5a256ea9634602658d6

  • SSDEEP

    3072:SX1fJNTi+bYWtnBOILd9DQBwUjWZ6RZLTNwEKWmAMMMVgdxo9p:SX1r7bt97M1XCKm

Score
10/10

Malware Config

Extracted

Family

xworm

C2

social-decorative.gl.at.ply.gg:29942

find-soup.gl.at.ply.gg:29942

Attributes
  • Install_directory

    %LocalAppData%

  • install_file

    XClient.exe

Targets

    • Target

      Wave.exe

    • Size

      130KB

    • MD5

      4fa4956530f548fdfc29e7d6ad8d9149

    • SHA1

      3146c36d53fa811d1f2c2fd7edb0c6b88db22593

    • SHA256

      0ffa8670ef82a5a5613da3ef8f7aafb8fb75c254a33981d9a6254ccbce768d46

    • SHA512

      f4410db293bd40516f8dd8fa5f15bc7a0ed276790e5094ca013b48cf847b69595b9efcd7c12f0b68c381b46ed42fc24419c435c10494c5a256ea9634602658d6

    • SSDEEP

      3072:SX1fJNTi+bYWtnBOILd9DQBwUjWZ6RZLTNwEKWmAMMMVgdxo9p:SX1r7bt97M1XCKm

    Score
    10/10
    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

    • Xworm family

    • Drops startup file

MITRE ATT&CK Enterprise v15

Tasks