General

  • Target

    https://github.com/Kaelithan/Asset-Grabber-/raw/refs/heads/main/AssetGrabberSetup.exe

  • Sample

    250302-xc3qya1pw2

Malware Config

Extracted

Family

xworm

C2

lot-theta.gl.at.ply.gg:6615

Attributes
  • Install_directory

    %AppData%

  • install_file

    svchost.exe

Targets

    • Target

      https://github.com/Kaelithan/Asset-Grabber-/raw/refs/heads/main/AssetGrabberSetup.exe

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

    • Xworm family

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v15

Tasks