Overview

overview

10

Static

static

10

triggerbot.exe

windows7-x64

10

triggerbot.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    triggerbot.exe

  • Size

    66KB

  • Sample

    250306-3evq1a1jw2

  • MD5

    3c29f913ec259219393ed6ed34095f7f

  • SHA1

    a44d686af7756b548373525b3cb921c44d0b67b2

  • SHA256

    e65c82b121ec90f36fc4193e8e7f850312107c441e8a2cfa4e6b844cb6462485

  • SHA512

    3a3e5a676a0541b9d5697c5f6f7b71deadae1e9633ff919cfdf68f9288f4b5dfb91c38a6af0fbbe23aaab5d08e1b6f409bf33134390a54ca023c916f3d5ecf50

  • SSDEEP

    1536:vFVqX0n8XtajJvNDbsPSKoZr66tFOgUu9x6:9Yq8XQBbsT0FO7j

Score
10/10
xwormrattrojan

Malware Config

Extracted

Family

xworm

Attributes
  • Install_directory

    %AppData%

  • install_file

    XClient.exe

  • pastebin_url

    https://pastebin.com/raw/kU06s0Rk

Targets

    • Target

      triggerbot.exe

    • Size

      66KB

    • MD5

      3c29f913ec259219393ed6ed34095f7f

    • SHA1

      a44d686af7756b548373525b3cb921c44d0b67b2

    • SHA256

      e65c82b121ec90f36fc4193e8e7f850312107c441e8a2cfa4e6b844cb6462485

    • SHA512

      3a3e5a676a0541b9d5697c5f6f7b71deadae1e9633ff919cfdf68f9288f4b5dfb91c38a6af0fbbe23aaab5d08e1b6f409bf33134390a54ca023c916f3d5ecf50

    • SSDEEP

      1536:vFVqX0n8XtajJvNDbsPSKoZr66tFOgUu9x6:9Yq8XQBbsT0FO7j

    Score
    10/10
    xwormrattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Xworm family

      xworm

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks