General

  • Target

    c747fa1d2915a681c7240ccb0ac04840e1344f006df764bcdddde5262460697d

  • Size

    339KB

  • Sample

    250302-fgg7csvxgv

  • MD5

    6e54f65079ae6203a2589f1250776dc0

  • SHA1

    070f3f2c2984740d76a0a2b52e912739b0f9deff

  • SHA256

    c747fa1d2915a681c7240ccb0ac04840e1344f006df764bcdddde5262460697d

  • SHA512

    969349157e06736d74497ffd27968f5b52136361441ec42e17da3e68d79757ed7a525461c391e93c885cb6fe15ee621182191d0c04d9b5154e9ecec5c047c143

  • SSDEEP

    6144:AB8eIaJMXa0VVWxID1a5RC/e99rKWqDdDco0d9LPXRh:tciXa0HWxIJa5RG2b+svRh

Score
10/10

Malware Config

Extracted

Family

xworm

Version

5.0

C2

alyoung-kb.duckdns.org:30120

Mutex

ZL52PqUOqTMNbXKU

Attributes
  • Install_directory

    %AppData%

  • install_file

    制制美美.exe

aes.plain

Targets

    • Target

      c747fa1d2915a681c7240ccb0ac04840e1344f006df764bcdddde5262460697d

    • Size

      339KB

    • MD5

      6e54f65079ae6203a2589f1250776dc0

    • SHA1

      070f3f2c2984740d76a0a2b52e912739b0f9deff

    • SHA256

      c747fa1d2915a681c7240ccb0ac04840e1344f006df764bcdddde5262460697d

    • SHA512

      969349157e06736d74497ffd27968f5b52136361441ec42e17da3e68d79757ed7a525461c391e93c885cb6fe15ee621182191d0c04d9b5154e9ecec5c047c143

    • SSDEEP

      6144:AB8eIaJMXa0VVWxID1a5RC/e99rKWqDdDco0d9LPXRh:tciXa0HWxIJa5RG2b+svRh

    Score
    10/10
    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

    • Xworm family

MITRE ATT&CK Enterprise v15

Tasks