Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

EzYoria.exe

windows10-2004-x64

10

EzYoria.exe

windows10-ltsc 2021-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    EzYoria.exe

  • Size

    83KB

  • Sample

    250301-mcwbrayqs4

  • MD5

    52d768092e1a7a20f8bbd99a29d327ee

  • SHA1

    c9ff905213e0d75abe1bf8a50e107139f877f3fb

  • SHA256

    bae0ddee6ec71e72927070d988e6c6dd0cebd5fb36c3832ef9d86d7ac769175e

  • SHA512

    5e29d659a426abe99c87adf76ebe4f6fafb4c14dda1d1bd204a111590bd08e5dd9476ef79e87a4c83278a7399eb3d87630465fdf49983184e9bf3fb7b30b9a55

  • SSDEEP

    1536:T04cLr4sLyvTZRBDm33ZpxQq5INYbA0B7eeu9D8ESkz630yt3kNLvODUw0w/:Ixv4xdR433ZrQLCbAhp81V0ytEvOIwB/

Score
10/10
xwormrattrojan

Malware Config

Extracted

Family

xworm

C2

all-advocacy.gl.at.ply.gg:33270

26.ip.gl.ply.gg:33270
Attributes
  • Install_directory

    %AppData%

  • install_file

    XClient.exe

Targets

    • Target

      EzYoria.exe

    • Size

      83KB

    • MD5

      52d768092e1a7a20f8bbd99a29d327ee

    • SHA1

      c9ff905213e0d75abe1bf8a50e107139f877f3fb

    • SHA256

      bae0ddee6ec71e72927070d988e6c6dd0cebd5fb36c3832ef9d86d7ac769175e

    • SHA512

      5e29d659a426abe99c87adf76ebe4f6fafb4c14dda1d1bd204a111590bd08e5dd9476ef79e87a4c83278a7399eb3d87630465fdf49983184e9bf3fb7b30b9a55

    • SSDEEP

      1536:T04cLr4sLyvTZRBDm33ZpxQq5INYbA0B7eeu9D8ESkz630yt3kNLvODUw0w/:Ixv4xdR433ZrQLCbAhp81V0ytEvOIwB/

    Score
    10/10
    xwormrattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Xworm family

      xworm

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks