Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

BootstrapperNew.exe

windows7-x64

BootstrapperNew.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    BootstrapperNew.exe

  • Size

    68KB

  • Sample

    250301-qwpvvssqs4

  • MD5

    ba06c09b1c72827d265103eb77ec4e51

  • SHA1

    1248cc8e569ba391e556a978a4c525facf98f1de

  • SHA256

    6f7de381f35a662b0dc78422c670bc02ea0ea90ea8565d577d938d9ac296b239

  • SHA512

    8bdf160406cc6e43fa45098ad732fc59e600d72274ed50471745a9ecc0fee33b4d188e83559b71fa8c40e6ca8997b7c0fe1c4553ccd7e80657a6cce4c9b5cf89

  • SSDEEP

    1536:79uMdFE7rHp4xOXyPE9npfUW/boDmuk62fMDO/OzS:7E7e1uUW/boDwfMDO/mS

Score
10/10
xwormrattrojan

Malware Config

Extracted

Family

xworm

C2

anti-dude.gl.at.ply.gg:33648

Attributes
  • Install_directory

    %AppData%

  • install_file

    System.exe

Targets

    • Target

      BootstrapperNew.exe

    • Size

      68KB

    • MD5

      ba06c09b1c72827d265103eb77ec4e51

    • SHA1

      1248cc8e569ba391e556a978a4c525facf98f1de

    • SHA256

      6f7de381f35a662b0dc78422c670bc02ea0ea90ea8565d577d938d9ac296b239

    • SHA512

      8bdf160406cc6e43fa45098ad732fc59e600d72274ed50471745a9ecc0fee33b4d188e83559b71fa8c40e6ca8997b7c0fe1c4553ccd7e80657a6cce4c9b5cf89

    • SSDEEP

      1536:79uMdFE7rHp4xOXyPE9npfUW/boDmuk62fMDO/OzS:7E7e1uUW/boDwfMDO/mS

    Score
    10/10
    xwormrattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Xworm family

      xworm

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks