Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

WindowsApp1.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    WindowsApp1.exe

  • Size

    245KB

  • Sample

    250228-2ajx9szzgs

  • MD5

    f334e175272ea58ab4eccfd7fb4a83dc

  • SHA1

    6f11c828b02fdfff0c89f6134bb8d9375ea1c09e

  • SHA256

    3394f09f5b509f4f86c9c3ceb9b242c0983409dcc7770151a21cb6cfaa9c101e

  • SHA512

    4769749b1bd79a79ba00f369b7cad5b65ccac460cd537f03786aa98b03e84f297870204e540d0d835152020ae98c459faf64524c16b8acb4c9646e1acd5c63ff

  • SSDEEP

    3072:a6SvDuqBL7D71KQ4EvoGjxdylXPw/AiOcGRnzOP4iV7+N0uHllaf5lCp2V4Nb:a6SvKsL7YPCMwgfFc4iVHuHllaf5s4S

Score
10/10
xwormrattrojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

paul-nw.gl.at.ply.gg:51413

Mutex

AVvzTAnLyW8qQCcO

Attributes
  • Install_directory

    %AppData%

  • install_file

    kev.exe

aes.plain

Targets

    • Target

      WindowsApp1.exe

    • Size

      245KB

    • MD5

      f334e175272ea58ab4eccfd7fb4a83dc

    • SHA1

      6f11c828b02fdfff0c89f6134bb8d9375ea1c09e

    • SHA256

      3394f09f5b509f4f86c9c3ceb9b242c0983409dcc7770151a21cb6cfaa9c101e

    • SHA512

      4769749b1bd79a79ba00f369b7cad5b65ccac460cd537f03786aa98b03e84f297870204e540d0d835152020ae98c459faf64524c16b8acb4c9646e1acd5c63ff

    • SSDEEP

      3072:a6SvDuqBL7D71KQ4EvoGjxdylXPw/AiOcGRnzOP4iV7+N0uHllaf5lCp2V4Nb:a6SvKsL7YPCMwgfFc4iVHuHllaf5s4S

    Score
    10/10
    xwormrattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Xworm family

      xworm

    • Executes dropped EXE

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks