Overview

overview

10

Static

static

10

client.exe

windows7-x64

10

client.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    client.exe

  • Size

    80KB

  • Sample

    250302-svxkesxvaw

  • MD5

    7e028a072945e09c9fc3e168381785ba

  • SHA1

    05ba385c085115d3aa609f7acac84b26efdaea09

  • SHA256

    8fc1e6e58a78efe8c6e44c8c01665041061ab87a8c325ab82f8cc2dafa9ed5c4

  • SHA512

    9962d9f9fa938e5bf09c0b56c8fb659876878ab25fa59855790c534356d0c2d6094520ebbcc656b3391466c08249efbe5729a9f7f77bf885b52c2edd86e8704d

  • SSDEEP

    1536:AEkYhskM6saLAbPV0H25ibjLNoelSK+r6R0f6LO6nF1Zw02:pHPW5ibjxoe3+jiLOoN12

Score
10/10
xwormrattrojan

Malware Config

Targets

    • Target

      client.exe

    • Size

      80KB

    • MD5

      7e028a072945e09c9fc3e168381785ba

    • SHA1

      05ba385c085115d3aa609f7acac84b26efdaea09

    • SHA256

      8fc1e6e58a78efe8c6e44c8c01665041061ab87a8c325ab82f8cc2dafa9ed5c4

    • SHA512

      9962d9f9fa938e5bf09c0b56c8fb659876878ab25fa59855790c534356d0c2d6094520ebbcc656b3391466c08249efbe5729a9f7f77bf885b52c2edd86e8704d

    • SSDEEP

      1536:AEkYhskM6saLAbPV0H25ibjLNoelSK+r6R0f6LO6nF1Zw02:pHPW5ibjxoe3+jiLOoN12

    Score
    10/10
    xwormrattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Xworm family

      xworm

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks