Overview

overview

10

Static

static

10

WMI Provider Host.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    WMI Provider Host.exe

  • Size

    57KB

  • Sample

    250304-z91nys1wbt

  • MD5

    7f4631cc67828fc55d6c8bd1af02bf44

  • SHA1

    54d6e1c3e0b655d231d461e32d187c0f2338295d

  • SHA256

    5361c6e459fd49ee6a11f586c5dd3a2626f1338cdc4ce661287f48966451a6dd

  • SHA512

    f931f8bde5aa6c2d528031fd5505eb6a0044edddcd1c5798ef762102e8d59e5701087259258d5cc15fea59e1e199f2c870fa95ad748a8e20680096cc4d62c348

  • SSDEEP

    1536:OP+vE3HHz3CIF9SYpNchQjbZ6cyW/bbOq4:O5T3CIF9SYE6bZH/bbOj

Score
10/10
xwormrattrojan

Malware Config

Extracted

Family

xworm

Attributes
  • Install_directory

    %port%

  • install_file

    svchost.exe

  • pastebin_url

    https://pastebin.com/raw/GMv8QPCE

Targets

    • Target

      WMI Provider Host.exe

    • Size

      57KB

    • MD5

      7f4631cc67828fc55d6c8bd1af02bf44

    • SHA1

      54d6e1c3e0b655d231d461e32d187c0f2338295d

    • SHA256

      5361c6e459fd49ee6a11f586c5dd3a2626f1338cdc4ce661287f48966451a6dd

    • SHA512

      f931f8bde5aa6c2d528031fd5505eb6a0044edddcd1c5798ef762102e8d59e5701087259258d5cc15fea59e1e199f2c870fa95ad748a8e20680096cc4d62c348

    • SSDEEP

      1536:OP+vE3HHz3CIF9SYpNchQjbZ6cyW/bbOq4:O5T3CIF9SYE6bZH/bbOj

    Score
    10/10
    xwormrattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Xworm family

      xworm

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1

MITRE ATT&CK Matrix

Tasks