Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

COM Surrogate.exe

windows7-x64

10

COM Surrogate.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    COM Surrogate.exe

  • Size

    56KB

  • Sample

    250228-ppqcdayyfz

  • MD5

    d630076a81a54f9be10b445948be037a

  • SHA1

    b1dc7ff1fe7dbf7e0e6666a86cfa40fde5e39906

  • SHA256

    5c95cee65a2fbf29f3ae2cefbff0500f3f96f935b69d56377aa7d9af618e32d1

  • SHA512

    6a8ee1536c45812259851440dda661db07d4c64cadf36bd56635016621e81f46ed33be50f559247300885e3011018ef7ebcf5e4bea10f6b41c4a1c1a7e06597f

  • SSDEEP

    768:yB/Xz+KwAhKUCFFjSLv9UcQlWhwTF+bi0JT8tbE3SdXHx14w6LgFOJhBtwcawS+:y/yxGUcWB+eMabE3614w68FOJDaR+

Score
10/10
xwormrattrojan

Malware Config

Extracted

Family

xworm

C2

redslide-36078.portmap.host:36078

Attributes
  • Install_directory

    %AppData%

  • install_file

    USB.exe

Targets

    • Target

      COM Surrogate.exe

    • Size

      56KB

    • MD5

      d630076a81a54f9be10b445948be037a

    • SHA1

      b1dc7ff1fe7dbf7e0e6666a86cfa40fde5e39906

    • SHA256

      5c95cee65a2fbf29f3ae2cefbff0500f3f96f935b69d56377aa7d9af618e32d1

    • SHA512

      6a8ee1536c45812259851440dda661db07d4c64cadf36bd56635016621e81f46ed33be50f559247300885e3011018ef7ebcf5e4bea10f6b41c4a1c1a7e06597f

    • SSDEEP

      768:yB/Xz+KwAhKUCFFjSLv9UcQlWhwTF+bi0JT8tbE3SdXHx14w6LgFOJhBtwcawS+:y/yxGUcWB+eMabE3614w68FOJDaR+

    Score
    10/10
    xwormrattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Xworm family

      xworm

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks