Overview

overview

10

Static

static

10

MasonClient.exe

windows10-ltsc 2021-x64

10

MasonClient.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    MasonClient.exe

  • Size

    51KB

  • Sample

    250305-y2j6kaxwfx

  • MD5

    267f96e9cd6585f1e6a3c3355dd4f369

  • SHA1

    26320160eebc17cdba76207aba90a86232b499f1

  • SHA256

    1411578fadcbab87b3b8d3d655938bc9cf1fc71768c61708d14167df76b0b32b

  • SHA512

    6e6cb8f26c12347d776d7503177a626d2daa35f93bb5a85db363cdee18c984e9bf59d69fc9d27a3c8b48c3485f5306b1b2201e81961ef3d35dabb0147db39241

  • SSDEEP

    768:Jh6+oFtLVtEEdzq0NZSpC5uFbowl8OK9ax7b4YvPtzD8v9OlrhJO7qpn:JIPZiEdzq0NZUvKoBb4YvP9DpbOKn

Score
10/10
xwormrattrojan

Malware Config

Extracted

Family

xworm

Attributes
  • Install_directory

    %port%

  • install_file

    USB.exe

  • pastebin_url

    https://pastebin.com/raw/knVPJWgB

Targets

    • Target

      MasonClient.exe

    • Size

      51KB

    • MD5

      267f96e9cd6585f1e6a3c3355dd4f369

    • SHA1

      26320160eebc17cdba76207aba90a86232b499f1

    • SHA256

      1411578fadcbab87b3b8d3d655938bc9cf1fc71768c61708d14167df76b0b32b

    • SHA512

      6e6cb8f26c12347d776d7503177a626d2daa35f93bb5a85db363cdee18c984e9bf59d69fc9d27a3c8b48c3485f5306b1b2201e81961ef3d35dabb0147db39241

    • SSDEEP

      768:Jh6+oFtLVtEEdzq0NZSpC5uFbowl8OK9ax7b4YvPtzD8v9OlrhJO7qpn:JIPZiEdzq0NZUvKoBb4YvP9DpbOKn

    Score
    10/10
    xwormrattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Xworm family

      xworm

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks