Overview

overview

10

Static

static

10

XWorm V5.6/NAudio.dll

windows11-21h2-x64

6

XWorm V5.6...on.dll

windows11-21h2-x64

8

XWorm V5.6...ws.dll

windows11-21h2-x64

8

XWorm V5.6...at.dll

windows11-21h2-x64

8

XWorm V5.6...um.dll

windows11-21h2-x64

8

XWorm V5.6...rd.dll

windows11-21h2-x64

8

XWorm V5.6...ss.dll

windows11-21h2-x64

8

XWorm V5.6...er.dll

windows11-21h2-x64

3

XWorm V5.6...er.dll

windows11-21h2-x64

8

XWorm V5.6...er.dll

windows11-21h2-x64

8

XWorm V5.6...DP.dll

windows11-21h2-x64

8

XWorm V5.6...NC.dll

windows11-21h2-x64

8

XWorm V5.6...ry.dll

windows11-21h2-x64

8

XWorm V5.6...ps.dll

windows11-21h2-x64

8

XWorm V5.6...ns.dll

windows11-21h2-x64

3

XWorm V5.6...er.dll

windows11-21h2-x64

8

XWorm V5.6...ps.dll

windows11-21h2-x64

8

XWorm V5.6...ox.dll

windows11-21h2-x64

8

XWorm V5.6...ne.dll

windows11-21h2-x64

8

XWorm V5.6...er.dll

windows11-21h2-x64

8

XWorm V5.6...ns.dll

windows11-21h2-x64

8

XWorm V5.6...me.dll

windows11-21h2-x64

8

XWorm V5.6...ce.dll

windows11-21h2-x64

8

XWorm V5.6...er.dll

windows11-21h2-x64

8

XWorm V5.6...ms.dll

windows11-21h2-x64

8

XWorm V5.6...re.dll

windows11-21h2-x64

8

XWorm V5.6...ry.dll

windows11-21h2-x64

8

XWorm V5.6...it.dll

windows11-21h2-x64

8

XWorm V5.6...op.dll

windows11-21h2-x64

8

XWorm V5.6...xy.dll

windows11-21h2-x64

8

XWorm V5.6...PE.dll

windows11-21h2-x64

8

XWorm V5.6...er.dll

windows11-21h2-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    XWorm V5.6.rar

  • Size

    15.3MB

  • Sample

    250216-2fqyrs1kdm

  • MD5

    9ad68c369b988fbcfd1f701842727683

  • SHA1

    c417d4ee0cecf17ac98155bfa093826421e27ab7

  • SHA256

    054095ca6c15c03ff8115800f114a3959fbe68a8bc1db1f1c57eb95f6c318674

  • SHA512

    4e089e568dcf4d2cd92d03456a1c9fed191b271c9e6b1e6635503522cb0bead8495507baf2b7881e5c3071fde9171e35c7099b00e67cacc43ac132d3cdc1539c

  • SSDEEP

    393216:fyaZDQe35+5J2yY79z/kf9YCZ0TSu96PzuZ4mHSD:fyuh35cJq79zkfy+u4PziI

Score
10/10
asyncratstormkittyxwormdefaultadwarediscoverypersistenceprivilege_escalationratstealer

Malware Config

Extracted

Family

asyncrat

Botnet

Default

C2

127.0.0.1:5000

127.0.0.1:58114

corexcxxx-58114.portmap.host:5000

corexcxxx-58114.portmap.host:58114
Attributes
  • delay

    1

  • install

    true

  • install_file

    system.exe

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      XWorm V5.6/NAudio.dll

    • Size

      502KB

    • MD5

      3b87d1363a45ce9368e9baec32c69466

    • SHA1

      70a9f4df01d17060ec17df9528fca7026cc42935

    • SHA256

      81b3f1dc3f1eac9762b8a292751a44b64b87d0d4c3982debfdd2621012186451

    • SHA512

      1f07d3b041763b4bc31f6bd7b181deb8d34ff66ec666193932ffc460371adbcd4451483a99009b9b0b71f3864ed5c15c6c3b3777fabeb76f9918c726c35eb7d7

    • SSDEEP

      6144:96/i10SZtfzWctj98vZcE0wmLlaIZs5eku2sX2hrjAzvgmXa6W9FwsT9idwktQZG:9yrSKMJR9aGs55T1X9Fwspi2tGpmS

    Score
    6/10
    discovery

    • Downloads MZ/PE file

    behavioral1

    • Target

      XWorm V5.6/Newtonsoft.Json.dll

    • Size

      695KB

    • MD5

      195ffb7167db3219b217c4fd439eedd6

    • SHA1

      1e76e6099570ede620b76ed47cf8d03a936d49f8

    • SHA256

      e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d

    • SHA512

      56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac

    • SSDEEP

      12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/

    Score
    8/10
    discovery

    • Downloads MZ/PE file

    behavioral2

    • Target

      XWorm V5.6/Plugins/ActiveWindows.dll

    • Size

      14KB

    • MD5

      5a766a4991515011983ceddf7714b70b

    • SHA1

      4eb00ae7fe780fa4fe94cedbf6052983f5fd138b

    • SHA256

      567b9861026a0dbc5947e7515dc7ab3f496153f6b3db57c27238129ec207fc52

    • SHA512

      4bd6b24e236387ff58631207ea42cd09293c3664468e72cd887de3b3b912d3795a22a98dcf4548fb339444337722a81f8877abb22177606d765d78e48ec01fd8

    • SSDEEP

      384:vRt5r7olU5QrGPbMrodT8ptsY7XZ1EDI6:vRtSRrGPb9t0Z1ED7

    Score
    8/10
    discovery

    • Downloads MZ/PE file

    behavioral3

    • Target

      XWorm V5.6/Plugins/Chat.dll

    • Size

      18KB

    • MD5

      59f75c7ffaccf9878a9d39e224a65adf

    • SHA1

      46b0f61a07e85e3b54b728d9d7142ddc73c9d74b

    • SHA256

      aab20f465955d77d6ec3b5c1c5f64402a925fb565dda5c8e38c296cb7406e492

    • SHA512

      80056163b96ce7a8877874eaae559f75217c0a04b3e3d4c1283fe23badfc95fe4d587fd27127db4be459b8a3adf41900135ea12b0eeb4187adbcf796d9505cb8

    • SSDEEP

      384:4MOna4ifKQtuUvl0BY0iYUsBG/crwTKvh6GIKoIafWUWmfN:vKQtuq2Y0lUUG0r0pIafWXe

    Score
    8/10
    discovery

    • Downloads MZ/PE file

    behavioral4

    • Target

      XWorm V5.6/Plugins/Chromium.dll

    • Size

      32KB

    • MD5

      edb2f0d0eb08dcd78b3ddf87a847de01

    • SHA1

      cc23d101f917cad3664f8c1fa0788a89e03a669c

    • SHA256

      b6d8bccdf123ceac6b9642ad3500d4e0b3d30b9c9dd2d29499d38c02bd8f9982

    • SHA512

      8f87da834649a21a908c95a9ea8e2d94726bd9f33d4b7786348f6371dfae983cc2b5b5d4f80a17a60ded17d4eb71771ec25a7c82e4f3a90273c46c8ee3b8f2c3

    • SSDEEP

      768:6SyQlmUmBlEu0FXfjq2sgDrLjfcVJ5sN9aWdMIxbKhJ+GEq3ZsL5f62:3yQltmBlmFXfjq2sgDrLjfcVJ5sNkQOa

    Score
    8/10
    discovery

    • Downloads MZ/PE file

    behavioral5

    • Target

      XWorm V5.6/Plugins/Clipboard.dll

    • Size

      14KB

    • MD5

      831eb0de839fc13de0abab64fe1e06e7

    • SHA1

      53aad63a8b6fc9e35c814c55be9992abc92a1b54

    • SHA256

      e31a1c2b1baa2aa2c36cabe3da17cd767c8fec4c206bd506e889341e5e0fa959

    • SHA512

      2f61bcf972671d96e036b3c99546cd01e067bef15751a87c00ba6d656decb6b69a628415e5363e650b55610cf9f237585ada7ce51523e6efc0e27d7338966bee

    • SSDEEP

      192:xh23MTInqHX7qRlrZk1/X7eOFXgNTer149iY6IW1mX/YWMqS7RSLOIU:cTWElV0/X7eUSTe5Wi2X/ShIU

    Score
    8/10
    discovery

    • Downloads MZ/PE file

    behavioral6

    • Target

      XWorm V5.6/Plugins/Cmstp-Bypass.dll

    • Size

      11KB

    • MD5

      cf15259e22b58a0dfd1156ab71cbd690

    • SHA1

      3614f4e469d28d6e65471099e2d45c8e28a7a49e

    • SHA256

      fa420fd3d1a5a2bb813ef8e6063480099f19091e8fa1b3389004c1ac559e806b

    • SHA512

      7302a424ed62ec20be85282ff545a4ca9e1aecfe20c45630b294c1ae72732465d8298537ee923d9e288ae0c48328e52ad8a1a503e549f8f8737fabe2e6e9ad38

    • SSDEEP

      192:KpXpS1QWlPkiqdE7FNNGGO9mWbpGkjgyaYcIW1vr/8TNU7aL7YiLsO08hdW5:Kp5IfL0mWbEkUyaYir/oNJL7KQ

    Score
    8/10
    discovery

    • Downloads MZ/PE file

    behavioral7

    • Target

      XWorm V5.6/Plugins/FileManager.dll

    • Size

      679KB

    • MD5

      641a8b61cb468359b1346a0891d65b59

    • SHA1

      2cdc49bcd7428fe778a94cdcd19cabf5ece8c9c0

    • SHA256

      b58ed3ebbcd27c7f4b173819528ff4db562b90475a5e304521ed5c564d39fffd

    • SHA512

      042702d34664ea6288e891c9f7aa10a5b4b07317f25f82d6c9fa9ba9b98645c14073d0f66637060b416a30c58dec907d9383530320a318523c51f19ebd0a4fee

    • SSDEEP

      12288:bVnchrRTHcQ3nrn6xtI9qR5WcygA5KeirCDD/:btJQ3nrnMI9MUlr5Kei+DD/

    Score
    3/10
    discovery
    behavioral8

    • Target

      XWorm V5.6/Plugins/FilesSearcher.dll

    • Size

      478KB

    • MD5

      6f8f1621c16ac0976600146d2217e9d2

    • SHA1

      b6aa233b93aae0a17ee8787576bf0fbc05cedde4

    • SHA256

      e66e1273dc59ee9e05ce3e02f1b760b18dd296a47d92b3ce5b24efb48e5fb21b

    • SHA512

      eb55acdea8648c8cdefee892758d9585ff81502fc7037d5814e1bd01fee0431f4dde0a4b04ccb2b0917e1b11588f2dc9f0bfe750117137a01bbd0c508f43ef6a

    • SSDEEP

      6144:ZAHdfUpnnBuIbE7SCQeGtSV41QJDsTDDh0Yhe6dwxLV/Quhg08OwR75:yVUpnkZ7slS4Ys50ie6Cfzg0M

    Score
    8/10
    discovery

    • Downloads MZ/PE file

    behavioral9

    • Target

      XWorm V5.6/Plugins/HBrowser.dll

    • Size

      25KB

    • MD5

      f0e921f2f850b7ec094036d20ff9be9b

    • SHA1

      3b2d76d06470580858cc572257491e32d4b021c0

    • SHA256

      75e8ff57fa6d95cf4d8405bffebb2b9b1c55a0abba0fe345f55b8f0e88be6f3c

    • SHA512

      16028ae56cd1d78d5cb63c554155ae02804aac3f15c0d91a771b0dcd5c8df710f39481f6545ca6410b7cd9240ec77090f65e3379dcfe09f161a3dff6aec649f3

    • SSDEEP

      384:tp33X3L5/QrX8nB9d13+6HcLReMWaFnp9l/1DRVTbg0Ut4xh+TfYMoKAB1R:tR3nL5/QrQ13kRR9bTbz+DYMoFBf

    Score
    8/10
    discovery

    • Downloads MZ/PE file

    behavioral10

    • Target

      XWorm V5.6/Plugins/HRDP.dll

    • Size

      1.7MB

    • MD5

      f27b6e8cf5afa8771c679b7a79e11a08

    • SHA1

      6c3fcf45e35aaf6b747f29a06108093c284100da

    • SHA256

      4aa18745a5fddf7ec14adaff3ad1b4df1b910f4b6710bf55eb27fb3942bb67de

    • SHA512

      0d84966bbc9290b04d2148082563675ec023906d58f5ba6861c20542271bf11be196d6ab24e48372f339438204bd5c198297da98a19fddb25a3df727b5aafa33

    • SSDEEP

      24576:3rKxoVT2iXc+IZ++6WiaTAsN/3ebTvK+63CWH8iA/iD2hgPjcC8SVdKumYr7:WHZ5pdqYH8ia6GcKuR7

    Score
    8/10
    discovery

    • Downloads MZ/PE file

    behavioral11

    • Target

      XWorm V5.6/Plugins/HVNC.dll

    • Size

      58KB

    • MD5

      30eb33588670191b4e74a0a05eecf191

    • SHA1

      08760620ef080bb75c253ba80e97322c187a6b9f

    • SHA256

      3a287acb1c89692f2c18596dd4405089ac998bb9cf44dd225e5211923d421e96

    • SHA512

      820cca77096ff2eea8e459a848f7127dc46af2e5f42f43b2b7375be6f4778c1b0e34e4aa5a97f7fbabe0b53dcd351d09c231bb9afedf7bcec60d949918a06b97

    • SSDEEP

      768:XsKVHERYe3lgPPTxOEUyP82P6mUrYrthCO7h2ORS9SQdHfiLpmbG8p:8K1ERYe0TEE3P82P1EMS36Kp

    Score
    8/10
    discovery

    • Downloads MZ/PE file

    behavioral12

    • Target

      XWorm V5.6/Plugins/HVNCMemory.dll

    • Size

      39KB

    • MD5

      065f0830d1e36f8f44702b0f567082e8

    • SHA1

      724c33558fcc8ecd86ee56335e8f6eb5bfeac0db

    • SHA256

      285b462e3cd4a5b207315ad33ee6965a8b98ca58abb8d16882e4bc2d758ff1a4

    • SHA512

      bac0148e1b78a8fde242697bff1bbe10a18ffab85fdced062de3dc5017cd77f0d54d8096e273523b8a3910fe17fac111724acffa5bec30e4d81b7b3bd312d545

    • SSDEEP

      768:EofXMCBlQ6Kms0n6GE30IU1YKtq9oQog1zq/xPP7:EyXTa6hEZU1YKwo8Uj

    Score
    8/10
    discovery

    • Downloads MZ/PE file

    behavioral13

    • Target

      XWorm V5.6/Plugins/HiddenApps.dll

    • Size

      45KB

    • MD5

      ba2141a7aefa1a80e2091bf7c2ca72db

    • SHA1

      9047b546ce9c0ea2c36d24a10eb31516a24a047d

    • SHA256

      6a098f5a7f9328b35d73ee232846b13e2d587d47f473cbc9b3f1d74def7086ea

    • SHA512

      91e43620e5717b699e34e658d6af49bba200dcf91ac0c9a0f237ec44666b57117a13bc8674895b7a9cac5a17b2f91cdc3daa5bcc52c43edbabd19bc1ed63038c

    • SSDEEP

      768:aEN0W4dmvWt9VG2LqIvwYGYRpXpWk/x0qqBi3qMG0gpfN3ffiCIT:SdmvWHVGMVwtYRtpl/x5qIXdEdXiCK

    Score
    8/10
    discovery

    • Downloads MZ/PE file

    behavioral14

    • Target

      XWorm V5.6/Plugins/Informations.dll

    • Size

      22KB

    • MD5

      67a884eeb9bd025a1ef69c8964b6d86f

    • SHA1

      97e00d3687703b1d7cc0939e45f8232016d009d9

    • SHA256

      cba453460be46cfa705817abbe181f9bf65dca6b6cea1ad31629aa08dbeaf72b

    • SHA512

      52e852021a1639868e61d2bd1e8f14b9c410c16bfca584bf70ae9e71da78829c1cada87d481e55386eec25646f84bb9f3baee3b5009d56bcbb3be4e06ffa0ae7

    • SSDEEP

      384:SCUEeL4D574MvGjydqXwxDJop0n3TmyxhxJNgSg4PbOFsK:SCXeL4DSjydqXwx1FjfNfwr

    Score
    3/10
    discovery
    behavioral15

    • Target

      XWorm V5.6/Plugins/Keylogger.dll

    • Size

      17KB

    • MD5

      246f7916c4f21e98f22cb86587acb334

    • SHA1

      b898523ed4db6612c79aad49fbd74f71ecdbd461

    • SHA256

      acfe5c3aa2a3bae3437ead42e90044d7eee972ead25c1f7486bea4a23c201d3a

    • SHA512

      1c256ca9b9857e6d393461b55e53175b7b0d88d8f3566fd457f2b3a4f241cb91c9207d54d8b0867ea0abd3577d127835beb13157c3e5df5c2b2b34b3339bd15d

    • SSDEEP

      192:rJV/HNfwK5RSpyv3RIw9RtO1Lnq4Ur1XneDN6IW1Y6Uph1KzaA0UbnnSLWqV:fFl5Rp3RntMO4U5uD8Upml0yhqV

    Score
    8/10
    adwarediscoverypersistenceprivilege_escalationstealer

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Downloads MZ/PE file

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

      persistenceprivilege_escalation

    • Executes dropped EXE

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware

    • Drops file in System32 directory

    behavioral16

    • Target

      XWorm V5.6/Plugins/Maps.dll

    • Size

      15KB

    • MD5

      806c3802bfd7a97db07c99a5c2918198

    • SHA1

      088393a9d96f0491e3e1cf6589f612aa5e1df5f8

    • SHA256

      34b532a4d0560e26b0d5b81407befdc2424aacc9ef56e8b13de8ad0f4b3f1ab6

    • SHA512

      ed164822297accd3717b4d8e3927f0c736c060bb7ec5d99d842498b63f74d0400c396575e9fa664ad36ae8d4285cfd91e225423a0c77a612912d66ea9f63356c

    • SSDEEP

      192:E0XOBqmqKYNg/ymxa07XW5U6chariK8GtnNK7gGteb1/C9T6IW14X/bmjIAd2vLV:mBqmqunYL6thaujK4jtepa9BX/bY1h2

    Score
    8/10
    discovery

    • Downloads MZ/PE file

    behavioral17

    • Target

      XWorm V5.6/Plugins/MessageBox.dll

    • Size

      14KB

    • MD5

      7db8b7e15194fa60ffed768b6cf948c2

    • SHA1

      3de1b56cc550411c58cd1ad7ba845f3269559b5c

    • SHA256

      bc09b671894c9a36f4eca45dd6fbf958a967acea9e85b66c38a319387b90dd29

    • SHA512

      e7f5430b0d46f133dc9616f9eeae8fb42f07a8a4a18b927dd7497de29451086629dfc5e63c0b2a60a4603d8421c6570967c5dbde498bb480aef353b3ed8e18a1

    • SSDEEP

      384:56lIcAn3tURnUKCvUUVT/95gG3UX/NZSQW9:56lIL3tUSvbVa/NZG

    Score
    8/10
    discovery

    • Downloads MZ/PE file

    behavioral18

    • Target

      XWorm V5.6/Plugins/Microphone.dll

    • Size

      540KB

    • MD5

      9c3d90ccf5d47f6eef83542bd08d5aeb

    • SHA1

      0c0aa80c3411f98e8db7a165e39484e8dae424c7

    • SHA256

      612898afdf9120cfef5843f9b136c66ecc3e0bb6f3d1527d0599a11988b7783c

    • SHA512

      0786f802fbd24d4ab79651298a5ba042c275d7d01c6ac2c9b3ca1e4ee952de7676ec8abf68d226b72696e9480bd4d4615077163efbcda7cff6a5f717736cbdfe

    • SSDEEP

      12288:+0OeMv3MrIb8CkZKobg3Wi1bRuSvazv+Uro:ROe+WIb8CkZLbg3Wa8Waz2j

    Score
    8/10
    discovery

    • Downloads MZ/PE file

    behavioral19

    • Target

      XWorm V5.6/Plugins/Ngrok-Installer.dll

    • Size

      400KB

    • MD5

      3e19341a940638536b4a7891d5b2b777

    • SHA1

      ca6f5b28e2e54f3f86fd9f45a792a868c82e35b5

    • SHA256

      b574aabf02a65aa3b6f7bfff0a574873ce96429d3f708a10f87bc1f6518f14aa

    • SHA512

      06639892ea4a27c8840872b0de450ae1a0dac61e1dcb64523973c629580323b723c0e9074ff2ddf9a67a8a6d45473432ffc4a1736c0ddc74e054ae13b774f3e2

    • SSDEEP

      12288:Ws6T2x75lFR/RG+BUKPqnwoCMYKIUTJE:WEB+4+1C0IU

    Score
    8/10
    discovery

    • Downloads MZ/PE file

    behavioral20

    • Target

      XWorm V5.6/Plugins/Options.dll

    • Size

      30KB

    • MD5

      97193fc4c016c228ae0535772a01051d

    • SHA1

      f2f6d56d468329b1e9a91a3503376e4a6a4d5541

    • SHA256

      5c34aee5196e0f8615b8d1d9017dd710ea28d2b7ac99295d46046d12eea58d78

    • SHA512

      9f6d7da779e8c9d7307f716d4a4453982bb7f090c35947850f13ec3c9472f058fc11e1120a9641326970b9846d3c691e0c2afd430c12e5e8f30abadb5dcf5ed2

    • SSDEEP

      768:ULxkuz7dDWH839iybgkf/sGRNW9S9dhjcI:ULNHqUPbgQsGRNW9S9

    Score
    8/10
    discovery

    • Downloads MZ/PE file

    behavioral21

    • Target

      XWorm V5.6/Plugins/Pastime.dll

    • Size

      17KB

    • MD5

      6430ab4458a703fb97be77d6bea74f5b

    • SHA1

      59786b619243d4e00d82b0a3b7e9deb6c71b283c

    • SHA256

      a46787527ac34cd71d96226ddfc0a06370b61e4ad0267105be2aec8d82e984c1

    • SHA512

      7b6cf7a613671826330e7f8daddc4c7c37b4d191cf4938c1f5b0fb7b467b28a23fb56e412dc82192595cfa9d5b552668ef0aaa938c8ae166029a610b246d3ecc

    • SSDEEP

      384:WK9Y5jI8MYODPqeivepi5zOY7//fNCsA8/h5U:WK9YNI8MVDZiWwr/TA8/hC

    Score
    8/10
    discovery

    • Downloads MZ/PE file

    behavioral22

    • Target

      XWorm V5.6/Plugins/Performance.dll

    • Size

      16KB

    • MD5

      1841c479da7efd24521579053efcf440

    • SHA1

      0aacfd06c7223b988584a381cb10d6c3f462fc6a

    • SHA256

      043b6a0284468934582819996dbaa70b863ab4caa4f968c81c39a33b2ac81735

    • SHA512

      3005e45728162cc04914e40a3b87a1c6fc7ffde5988d9ff382d388e9de4862899b3390567c6b7d54f0ec02283bf64bcd5529319ca32295c109a7420848fa3487

    • SSDEEP

      384:LtpW2/E3mawGD1XTgOw2QxHN7yVppy6+:JY2ImYRDKHxV

    Score
    8/10
    discovery

    • Downloads MZ/PE file

    behavioral23

    • Target

      XWorm V5.6/Plugins/ProcessManager.dll

    • Size

      19KB

    • MD5

      3d4ec14005a25a4cb05b1aa679cf22bf

    • SHA1

      6f4a827d94ad020bc23fbd04b7d8ca2995267094

    • SHA256

      7cf1921a5f8429b2b9e8197de195cfae2353fe0d8cb98e563bdf1e782fe2ee4e

    • SHA512

      0ee72d345d5431c7a6ffc71cf5e37938b93fd346e5a4746f5967f1aa2b69c34ca4ba0d0abd867778d8ca60b56f01e2d7fc5e7cf7c5a39a92015d4df2d68e382e

    • SSDEEP

      384:2dqZXY/oSd1PTQLvLELadRtZa/rnRvDSQUT5S97/Y5bLOEYQfwrpn45rDhUn1kAO:2dqZXWrQPQQtZqrRrlU+cYv1kAvZc

    Score
    8/10
    discovery

    • Downloads MZ/PE file

    behavioral24

    • Target

      XWorm V5.6/Plugins/Programs.dll

    • Size

      13KB

    • MD5

      a6734a047b0b57055807a4f33a80d4dd

    • SHA1

      0b3a78b2362b0fd3817770fdc6dd070e3305615c

    • SHA256

      953a8276faa4a18685d09cd9187ed3e409e3cccd7daf34b6097f1eb8d96125a4

    • SHA512

      7292eab25f0e340e78063f32961eff16bb51895ad46cfd09933c0c30e3315129945d111a877a191fc261ad690ad6b02e1f2cabc4ff2fdac962ee272b41dd6dfa

    • SSDEEP

      192:Z3eKcfO/TCOAOG+uCno9SFwN4O4FgkT8zr1P9YD6IW1GX/V3wd0yzSLWVb:8PG/TCXF1SamdnTu5lYTX/NwKyNVb

    Score
    8/10
    discovery

    • Downloads MZ/PE file

    behavioral25

    • Target

      XWorm V5.6/Plugins/Ransomware.dll

    • Size

      20KB

    • MD5

      ccc9ea43ead4aa754b91e2039fe0ac1c

    • SHA1

      f382635559045ac1aeb1368d74e6b5c6e98e6a48

    • SHA256

      14c2bbccdabb8408395d636b44b99de4b16db2e6bf35181cb71e7be516d83ad9

    • SHA512

      5d05254ba5cd7b1967a84d5b0e6fd23c54766474fb8660a001bf3d21a3f5c8c20fcdb830fb8659a90da96655e6ee818ceefb6afa610cc853b7fba84bb9db4413

    • SSDEEP

      384:DVSO27QJHvpebFn0LC9Tk7ff2ji+ZMuqI+sHY4k7E7eEDuQZh:DVm7Q1vpebF0LC9TqH2Mj7qtqg

    Score
    8/10
    discovery

    • Downloads MZ/PE file

    behavioral26

    • Target

      XWorm V5.6/Plugins/Recovery.dll

    • Size

      1.1MB

    • MD5

      776193701a2ed869b5f1b6e71970a0ac

    • SHA1

      2f973458531aaa283cdc835af4e24f5f709cbad1

    • SHA256

      66dbe3b90371fe58caa957e83c1c1f0acce941a36cf140a0f07e64403dd13303

    • SHA512

      a41f981c861e8d40487a9cd0863f9055165427e10580548e972a47ef47cf3e777aab2df70dc6f464cc3077860e86eda7462e9754f9047a1ecc0ed9721663aeb9

    • SSDEEP

      12288:LaoFeouLUFNFfcaFeFOFwcGF6cmFWc0FWc8cIcKcUFJFpcNcHc7cbchFFc5cbc1a:pFetLic805jbibGATp/j5T

    Score
    8/10
    discovery

    • Downloads MZ/PE file

    behavioral27

    • Target

      XWorm V5.6/Plugins/Regedit.dll

    • Size

      15KB

    • MD5

      53a2cfe273c311b64cf5eaca62f8c2fd

    • SHA1

      4ec95ec4777a0c5b4acde57a3490e1c139a8f648

    • SHA256

      2f73dc0f3074848575c0408e02079fd32b7497f8816222ae3ce8c63725a62fe6

    • SHA512

      992b37d92157ae70a106a9835de46a4ac156341208cfe7fb0477dc5fc3bc9ddae71b35e2336fc5c181630bac165267b7229f97be436912dfd9526a020d012948

    • SSDEEP

      384:0ZMOBwQbGwAspmewuYvpYr3fgr9A8/VjceZ:0ZMOykGRzYwA8/Vl

    Score
    8/10
    discovery

    • Downloads MZ/PE file

    behavioral28

    • Target

      XWorm V5.6/Plugins/RemoteDesktop.dll

    • Size

      18KB

    • MD5

      e6367d31cf5d16b1439b86ae6b7b31c3

    • SHA1

      f52f1e73614f2cec66dab6af862bdcb5d4d9cf35

    • SHA256

      cc52384910cee944ddbcc575a8e0177bfa6b16e3032438b207797164d5c94b34

    • SHA512

      8bc78a9b62f4226be146144684dc7fcd085bcf4d3d0558cb662aacc143d1438b7454e8ac70ca83ebeedc2a0fcea38ad8e77a5d926a85254b5a7d420a5605538a

    • SSDEEP

      384:nKr81F+CoNFZpeg7qX+mK3sxjt9l/C6I5YxBXWKeVFjyJ:KTvZY4gTPXBojG

    Score
    8/10
    discovery

    • Downloads MZ/PE file

    behavioral29

    • Target

      XWorm V5.6/Plugins/ReverseProxy.dll

    • Size

      16KB

    • MD5

      a22d11379e413cf832b3943ce46f2463

    • SHA1

      99b9552e8a25bff29678aff828901edbc23eaba5

    • SHA256

      8c4efe2c8702141ffa8ff8f55d248dc4220231ae8d12ecea1f22906a9285b32b

    • SHA512

      cc1eccb29135acd35804b44f73447bd8dedc8ea085dee3670cf49120baa905aa7ca512c14a3f4df6aeb5a70347bd214865f9dc8b709a00abbb0c745164d87074

    • SSDEEP

      384:sNsDP97BkZ3pBkHEk8G1QxFUzTNnrYFXoMZlS9yPCn:sNuR+ZZ+mScWfEoMZQ9yPg

    Score
    8/10
    discovery

    • Downloads MZ/PE file

    behavioral30

    • Target

      XWorm V5.6/Plugins/RunPE.dll

    • Size

      11KB

    • MD5

      224be01635cff2dca827fbdeaddb983c

    • SHA1

      11fa00c5e172c9cd1c81acaef52934f785f91374

    • SHA256

      7adfe849345edd76aa975b0647fed2ccaa5f4a6aaf7d55f488af939c0dbef153

    • SHA512

      1a4915b7b21e8166a6ddb6460c77e02c306a460c08fc7ee574832b0576c827db343eda9533959298819ee443790769328ad580fc67fe4817110b63d49248c736

    • SSDEEP

      192:vbfqh94qP9XFw3l+JNGGOueq1JtSnIW1fUse2po7SLOYN:vbChWqPj5jJtGUse2poHYN

    Score
    8/10
    discovery

    • Downloads MZ/PE file

    behavioral31

    • Target

      XWorm V5.6/Plugins/ServiceManager.dll

    • Size

      14KB

    • MD5

      2e5f127cb0a69cdd46aa4fd9e603f982

    • SHA1

      994a6ab276c417301ed9208aaaf6719bf9594bc6

    • SHA256

      c552d11db168a4f64db584283a617a6ec51ab6095c20ba4b706c3138beb68a22

    • SHA512

      4455cb3b9d4a9c69abec7180e9a60e16e6be0ae2290f48aa09c5d926370de5512ced4d37b6e6e49515d5f51999211eff6f751c4594db936882fb7f40ee5bf97e

    • SSDEEP

      192:D6FAiNLB2n5QnRBiMcs/XAaICPczrOFsgXTZr106Yq6IW1yShrM7+WAMLuO1Jjm:Ziq5QRBiMn/wpDUtTZ5nYsShY3AgJjm

    Score
    3/10
    discovery
    behavioral32

MITRE ATT&CK Enterprise v15

Tasks

static1

ratdefaultstormkittyxwormasyncrat
Score
10/10

behavioral1

discovery
Score
6/10

behavioral2

discovery
Score
8/10

behavioral3

discovery
Score
8/10

behavioral4

discovery
Score
8/10

behavioral5

discovery
Score
8/10

behavioral6

discovery
Score
8/10

behavioral7

discovery
Score
8/10

behavioral8

discovery
Score
3/10

behavioral9

discovery
Score
8/10

behavioral10

discovery
Score
8/10

behavioral11

discovery
Score
8/10

behavioral12

discovery
Score
8/10

behavioral13

discovery
Score
8/10

behavioral14

discovery
Score
8/10

behavioral15

discovery
Score
3/10

behavioral16

adwarediscoverypersistenceprivilege_escalationstealer
Score
8/10

behavioral17

discovery
Score
8/10

behavioral18

discovery
Score
8/10

behavioral19

discovery
Score
8/10

behavioral20

discovery
Score
8/10

behavioral21

discovery
Score
8/10

behavioral22

discovery
Score
8/10

behavioral23

discovery
Score
8/10

behavioral24

discovery
Score
8/10

behavioral25

discovery
Score
8/10

behavioral26

discovery
Score
8/10

behavioral27

discovery
Score
8/10

behavioral28

discovery
Score
8/10

behavioral29

discovery
Score
8/10

behavioral30

discovery
Score
8/10

behavioral31

discovery
Score
8/10

behavioral32

discovery
Score
3/10