Overview

overview

10

Static

static

10

макси...х.exe

windows10-ltsc 2021-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    максим лох.exe

  • Size

    41KB

  • Sample

    250305-xxql4sxjy4

  • MD5

    0011dad9c1a4c80a85c6ec8b6a3791ec

  • SHA1

    6c9e04a11aadfad3d5209fef124d85d0a7649ff2

  • SHA256

    9f096de5b225151543a66faa6ca95dc772c0167b7b75bf2dbec2c2ca64874491

  • SHA512

    f60dcf603907e3291e21378c5f413a0623358b30be05e05e6f55c1d025585a7959513d1c811fa68844fc7f7575fc6eeb99d8d695b0c1f452cd77f349b1e92cd3

  • SSDEEP

    768:NBFMiKhUsY5OEGsWyH6peAuwKFjHvdhtF5PG9+lOwh63EmXK:29hikvRya0AulzvdTFI9+lOws9XK

Score
10/10
xwormrattrojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

20.ip.gl.ply.gg:25905

pics-facial.gl.at.ply.gg:25905
Mutex

DbJdoPQAuynKdINr

Attributes
  • Install_directory

    %AppData%

  • install_file

    USB.exe

aes.plain

Targets

    • Target

      максим лох.exe

    • Size

      41KB

    • MD5

      0011dad9c1a4c80a85c6ec8b6a3791ec

    • SHA1

      6c9e04a11aadfad3d5209fef124d85d0a7649ff2

    • SHA256

      9f096de5b225151543a66faa6ca95dc772c0167b7b75bf2dbec2c2ca64874491

    • SHA512

      f60dcf603907e3291e21378c5f413a0623358b30be05e05e6f55c1d025585a7959513d1c811fa68844fc7f7575fc6eeb99d8d695b0c1f452cd77f349b1e92cd3

    • SSDEEP

      768:NBFMiKhUsY5OEGsWyH6peAuwKFjHvdhtF5PG9+lOwh63EmXK:29hikvRya0AulzvdTFI9+lOws9XK

    Score
    10/10
    xwormrattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Xworm family

      xworm

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1

MITRE ATT&CK Matrix

Tasks