Overview

overview

10

Static

static

10

injector-helper.exe

windows10-ltsc 2021-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    injector-helper.exe

  • Size

    278KB

  • Sample

    250303-mee3jsvzfx

  • MD5

    2c3457654d3268e0c527177aa5738884

  • SHA1

    95dce8a46d7ca3a99df76546378f0e0f8057c422

  • SHA256

    b506d66eef4bb110f80036842d35697abc39e2af3812515cdea956086b13ccd0

  • SHA512

    3d771cc4b213738956d84f968e339685693aa67d0feb377168baad6e5c2fd3c302bcf2f59818e058e6deb27ba35cc814d281bbd73e305ac7350144343d9bdbb6

  • SSDEEP

    1536:f5rETwYHmfqBzVhILYeGp6GLhblVcmlxDuvbsa/KcC6GO1OEgd+64ypXSG:flETZGfqBXjLhcmabsab6O1BvpypJ

Score
10/10
xwormrattrojan

Malware Config

Extracted

Family

xworm

Attributes
  • Install_directory

    %ProgramData%

  • install_file

    svchost.exe

  • pastebin_url

    https://pastebin.com/raw/CG1GJPSA

Targets

    • Target

      injector-helper.exe

    • Size

      278KB

    • MD5

      2c3457654d3268e0c527177aa5738884

    • SHA1

      95dce8a46d7ca3a99df76546378f0e0f8057c422

    • SHA256

      b506d66eef4bb110f80036842d35697abc39e2af3812515cdea956086b13ccd0

    • SHA512

      3d771cc4b213738956d84f968e339685693aa67d0feb377168baad6e5c2fd3c302bcf2f59818e058e6deb27ba35cc814d281bbd73e305ac7350144343d9bdbb6

    • SSDEEP

      1536:f5rETwYHmfqBzVhILYeGp6GLhblVcmlxDuvbsa/KcC6GO1OEgd+64ypXSG:flETZGfqBXjLhcmabsab6O1BvpypJ

    Score
    10/10
    xwormrattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Xworm family

      xworm

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1

MITRE ATT&CK Matrix

Tasks