General

  • Target

    Robux Generator.exe

  • Size

    45KB

  • Sample

    250304-yr7twayyet

  • MD5

    161ca9a58355ddb2726e250045f5a476

  • SHA1

    4573dd2df8a86e65d3727920b29ac6729b565e11

  • SHA256

    cfb7273e97219426b9d69c0a0b0130f1a9fb59b1de6eb003622ca3017818ef8d

  • SHA512

    d19d4812a293d0b00250446b0d814c7005692c66246ee7bd63c5867a9a0656b1661c81862e89f9b117dc40269e2c2a5bedbf7423f1a68bdae524de5c916a3fe1

  • SSDEEP

    768:jwh8ooVSFF0eObAvrSH7tF5Pa9qkcOwhY3/mXXyhgYQG:ZooVW0Av6xF49qkcOwy+XanX

Score
10/10

Malware Config

Extracted

Family

xworm

Version

5.0

C2

127.0.0.1:7000

Mutex

dlCpvOUBZJ74DV3m

Attributes
  • Install_directory

    %LocalAppData%

  • install_file

    USB.exe

aes.plain

Targets

    • Target

      Robux Generator.exe

    • Size

      45KB

    • MD5

      161ca9a58355ddb2726e250045f5a476

    • SHA1

      4573dd2df8a86e65d3727920b29ac6729b565e11

    • SHA256

      cfb7273e97219426b9d69c0a0b0130f1a9fb59b1de6eb003622ca3017818ef8d

    • SHA512

      d19d4812a293d0b00250446b0d814c7005692c66246ee7bd63c5867a9a0656b1661c81862e89f9b117dc40269e2c2a5bedbf7423f1a68bdae524de5c916a3fe1

    • SSDEEP

      768:jwh8ooVSFF0eObAvrSH7tF5Pa9qkcOwhY3/mXXyhgYQG:ZooVW0Av6xF49qkcOwy+XanX

    Score
    10/10
    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

    • Xworm family

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Matrix

Tasks