General

  • Target

    Pyramid.Phantom.Stager.exe

  • Size

    1.2MB

  • Sample

    250302-wspctazzdt

  • MD5

    9d27d2a205e5813827531a8003794b41

  • SHA1

    aa08a842219819331cfebd765c5308c80b0c20f9

  • SHA256

    d70001e484f2c8d5b03ee6afda18c69412cee89bd72f562a19882f2448975192

  • SHA512

    55bfe74e2cf11c1259f90f0019e5e92e26c3213d1fdcbd45fda446983ed0a32532d2f2631e5329fdb9b9cca53f51b5d275bf6d22175b79a8564f03d6423b35b2

  • SSDEEP

    24576:LeVrNptvfP3GxepR5B1F5hV6zZRd9dyMixqKncO7vBxDG:iVp/HP1pRL1FjV6zXd9GxqKncOj

Malware Config

Extracted

Family

xworm

Version

5.0

C2

meowycatty.ddns.net:8843

Mutex

jRccj8SKwN7fQIlB

Attributes
  • install_file

    USB.exe

aes.plain

Targets

    • Target

      Pyramid.Phantom.Stager.exe

    • Size

      1.2MB

    • MD5

      9d27d2a205e5813827531a8003794b41

    • SHA1

      aa08a842219819331cfebd765c5308c80b0c20f9

    • SHA256

      d70001e484f2c8d5b03ee6afda18c69412cee89bd72f562a19882f2448975192

    • SHA512

      55bfe74e2cf11c1259f90f0019e5e92e26c3213d1fdcbd45fda446983ed0a32532d2f2631e5329fdb9b9cca53f51b5d275bf6d22175b79a8564f03d6423b35b2

    • SSDEEP

      24576:LeVrNptvfP3GxepR5B1F5hV6zZRd9dyMixqKncO7vBxDG:iVp/HP1pRL1FjV6zXd9GxqKncOj

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

    • Xworm family

MITRE ATT&CK Enterprise v15

Tasks