Overview

overview

10

Static

static

10

ReduxMak.exe

windows7-x64

10

ReduxMak.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ReduxMak.exe

  • Size

    153KB

  • Sample

    250303-lw1j5svly6

  • MD5

    0cc3fd04d8c5f1d8bc962a0043201b7c

  • SHA1

    2bfeeda6d3c2e9b25c0a4316f5b0cf298b4a9ff3

  • SHA256

    93d76dca61ee80316248681350c8821c9659e78cde71066aeb85a680bea2add3

  • SHA512

    3a1b11e4dc241a2ff5d1da38fd9fadbcc67eb82539ea1e8549835efa7f4247b77928e38daea234d0ae6bf5b9ba866d7de41de7ee37e2418f8640be637f5f0ca2

  • SSDEEP

    3072:NmhnDsFs9CfOM/4NpVq8BxFRzaqF+o2GQJ7/JzqVfGvk:NgDWs9GgVqwlL

Score
10/10
xwormrattrojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

entertainment-rentals.gl.at.ply.gg:39424

Mutex

loMU85ScF1qly5lk

Attributes
  • Install_directory

    %Temp%

  • install_file

    Set.exe

aes.plain

Targets

    • Target

      ReduxMak.exe

    • Size

      153KB

    • MD5

      0cc3fd04d8c5f1d8bc962a0043201b7c

    • SHA1

      2bfeeda6d3c2e9b25c0a4316f5b0cf298b4a9ff3

    • SHA256

      93d76dca61ee80316248681350c8821c9659e78cde71066aeb85a680bea2add3

    • SHA512

      3a1b11e4dc241a2ff5d1da38fd9fadbcc67eb82539ea1e8549835efa7f4247b77928e38daea234d0ae6bf5b9ba866d7de41de7ee37e2418f8640be637f5f0ca2

    • SSDEEP

      3072:NmhnDsFs9CfOM/4NpVq8BxFRzaqF+o2GQJ7/JzqVfGvk:NgDWs9GgVqwlL

    Score
    10/10
    xwormrattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Xworm family

      xworm

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks