Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

we.exe

windows7-x64

10

we.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    we.exe

  • Size

    313KB

  • Sample

    250228-m6lz6szj15

  • MD5

    d1cc6b6a0bf9c9a89341eea7633f00bc

  • SHA1

    ff6f84b71ffdc05af654ecf28006206eeff0afcf

  • SHA256

    4ba863fc0a1da38b5e9e987e7e36cf0b7a8dfb6eebab1fd4eb09c8c1b7e4815d

  • SHA512

    dd73988ad22265d200da041d7b73af917f6e65642dda175759c6649a49cc7bfabc01493aa6938a3b987b88f4f8f5e81969ec60879141931e2d01e7a74a4a29fc

  • SSDEEP

    6144:viC0I27yJtJ71HfdgwBBArJW2ZTTdPDu8r6SE:vR0HIJR/dgwArJW2ZTTd6eE

Score
10/10
xwormdiscoveryrattrojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

185.7.214.211:4444

aes.plain

Targets

    • Target

      we.exe

    • Size

      313KB

    • MD5

      d1cc6b6a0bf9c9a89341eea7633f00bc

    • SHA1

      ff6f84b71ffdc05af654ecf28006206eeff0afcf

    • SHA256

      4ba863fc0a1da38b5e9e987e7e36cf0b7a8dfb6eebab1fd4eb09c8c1b7e4815d

    • SHA512

      dd73988ad22265d200da041d7b73af917f6e65642dda175759c6649a49cc7bfabc01493aa6938a3b987b88f4f8f5e81969ec60879141931e2d01e7a74a4a29fc

    • SSDEEP

      6144:viC0I27yJtJ71HfdgwBBArJW2ZTTdPDu8r6SE:vR0HIJR/dgwArJW2ZTTd6eE

    Score
    10/10
    xwormdiscoveryrattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Xworm family

      xworm

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks