Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

Confirmati...US.bat

windows7-x64

8

Confirmati...US.bat

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    01032025_0025_ConfirmationcopyforEFT_20250228_BOA_NY_E-SWFT050AX52951MX-US.bat.gz

  • Size

    33KB

  • Sample

    250301-axcnxstvfz

  • MD5

    d5d1e4c95a9b28ab25ff07785abb0342

  • SHA1

    650f647c95c0d61a97b05128dc568c959d4a4eff

  • SHA256

    3b792e3efcd49fa078b0f81556bae6a7bf3c58db676ae82221c001297e45a1bb

  • SHA512

    4945640d54f4d75c89fda79565ea769f72b9890e9e1ceddda76476fea732975419efb067a5fa75feae273bf05a5cf41433a8cfe643f0555585682e2169b1f8c1

  • SSDEEP

    768:dt6TndnbOvtt8J04Lk0+GWuKyY13p5hu5l+Zj:dt6TnlO1tqkDW21bM8

Score
10/10
xwormexecutionrattrojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

xinclas.vmcentra.top:2829

Mutex

DX77uB6mg61Bv7eW

Attributes
  • install_file

    USB.exe

aes.plain

Targets

    • Target

      Confirmation copy for EFT#_20250228_BOA_NY_E-SWFT050AX52951MX-US.bat

    • Size

      62KB

    • MD5

      4e49fd9891d84a4dff53559ce3fb1e4c

    • SHA1

      6b44eb8513213887a7cf7a21a2ef75472fb32bcf

    • SHA256

      6036593430cc74f68abc87c13469083968dc94f011d12c50c845c1a44751e409

    • SHA512

      feced2549a5da4ab69077b37a9cbf88824edc010cd8163025556c8c0c810b7599c1f982556bc613fa1cceee6467f2d89ad72ae467346546e4f848a4b62db2626

    • SSDEEP

      1536:5ImZkbmEKUgXEXzICKUnFCtb4+tD3Ezpaljp228c+:5I3Hfctb4UD3EzpVBc+

    Score
    10/10
    executionxwormrattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Xworm family

      xworm

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Drops startup file

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks