Analysis
-
max time kernel
91s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
-
submitted
05/03/2025, 20:19
General
-
Target
PlutoReaper/PlutoReaperV2/PROGRAMS.exe
-
Size
40KB
-
MD5
db690c068636611bdd7ae65e625aa4e1
-
SHA1
a85fa0cb046a2c730af238c4a16f5888a73bdd45
-
SHA256
8977fe9fa37d6a5146c8e3a537805534827d2f37f331d506564b5b51105515ce
-
SHA512
e3db52888f07a11a613e66e2b81801a91433ad2dc3182fb1e53801b1fb620d70946e49f746f4628cbc264a0314f56fde002ad5837aa18b5b4a7f3ca6780bdd89
-
SSDEEP
768:HdiWDOym2lzHubc4wJc29JJ7FFP7965LO9hQPuKWx:H1DOc1JPrZFT965LO9KSx
Score
10/10
Malware Config
Extracted
Family
xworm
Version
5.0
C2
field-aye.gl.at.ply.gg:24443
Mutex
MVUVp9tCaPyjpP9v
Attributes
-
Install_directory
%AppData%
-
install_file
Windows Defender.exe
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\PlutoReaper\PlutoReaperV2\PROGRAMS.exe"C:\Users\Admin\AppData\Local\Temp\PlutoReaper\PlutoReaperV2\PROGRAMS.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
1.0MB
-
Filesize
10.8MB