Overview

overview

10

Static

static

1

Destiny Mo...er.bat

windows11-21h2-x64

10

Destiny Mo...ll.cmd

windows11-21h2-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Destiny Mod Menu.rar

  • Size

    194KB

  • Sample

    250304-rmyl3sstcz

  • MD5

    d1e398e757c4a3e1c9887296cef12b34

  • SHA1

    197c715389fba91d476d395bb0c9439009b9a1da

  • SHA256

    10f65b5ff82a1838a20614cc7bf379e8f55c3d46ef9ecaba7837c17ec44ce49f

  • SHA512

    bafe205c3727f954d15d3046881a6989b4bd8541f472cdfa5bd22211616f97b5ff591fb45ef159ea910dce30fb98e034ff0bb8f9e237c629e75b59a78504ef28

  • SSDEEP

    6144:KR9UeLmjjYjgRT+IZbnVqjmxAvAhZrM/BBDnjMy0VMugzsS:Cyeak0hjZE2AoTWBfpugB

Score
10/10
xwormexecutionrattrojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

french-add.gl.at.ply.gg:6536

Mutex

db7vnqFX7vAc4WLR

Attributes
  • Install_directory

    %ProgramData%

  • install_file

    System.exe

aes.plain

Targets

    • Target

      Destiny Mod Menu/Destiny/Destiny Loader Installer.bat

    • Size

      265KB

    • MD5

      512d6ccd633decbe126a38c51c29a280

    • SHA1

      017e6fbb5eb2e367f37b4e5c33eb89cafcc7db48

    • SHA256

      411b2ce5f266c6b25a645c37e7fd071772810ae5c74cf457db20f43f43277fe5

    • SHA512

      fde1138b21117652348ec58f6ea92687fb94b111e0c49b5528d995a8e5e1588e7d1957761ca6eabb1010666f925b77a8032c129ec0839c5797a7e8381af24af7

    • SSDEEP

      6144:jhbd8sLlMG4UZT009TJPirdyKRxv4oPhdP:ld9Jdr96YitZdP

    Score
    10/10
    xwormexecutionrattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Xworm family

      xworm

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1

    • Target

      Destiny Mod Menu/Destiny/Unistall.cmd

    • Size

      652B

    • MD5

      cbcf3f62d09c0384fac1e9aa7864eaf9

    • SHA1

      ef3c625e9bb9437bea730533565a77cff3f442ac

    • SHA256

      2ff897d3073ba334e43ad3ca2e65b6297b74d72931f45eda6caf6082b5b22768

    • SHA512

      95b982a66a396c1e79371521957299bde29df1eab65f4b1905fc64530ab1a1d109ae597448a183b79c596874d730d7a6a52ea7836aba7f4ca7fc8a3d306654ac

    Score
    1/10
    behavioral2

MITRE ATT&CK Enterprise v15

Tasks