Overview

overview

10

Static

static

10

CHEATNEPIZDI.exe

windows7-x64

10

CHEATNEPIZDI.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    CHEATNEPIZDI.exe

  • Size

    197KB

  • Sample

    250306-pyw7aazjs4

  • MD5

    48c8a6d100fb89f92a8080697133d77f

  • SHA1

    19c8b82c1164575b88abea63cbff500fd5ec26b7

  • SHA256

    622cc6e79e17696dc0c8a621677765cabe8b48ce5d40881bf71b463223e16364

  • SHA512

    e440057421e96a2ed3043a828ffe9b0738c1c532d9bb63d214e8809a1e2d779e38e2b0cab3f539acac44216753fe7b47f8109e5ec7578873f6efc7a150630549

  • SSDEEP

    3072:Yd9xkHFE9jnOjE8SKfbzxcwg7es6/Vsb8VKTup49oJMfF/H9N3Ky9NzLnj:Y6E9XUhcX7elbKTuq9bfF/H9d9n

Score
10/10
xwormrattrojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

ohsorry-20836.portmap.host:20836

Mutex

WHNildkiUcLMmL9K

Attributes
  • install_file

    USB.exe

aes.plain

Targets

    • Target

      CHEATNEPIZDI.exe

    • Size

      197KB

    • MD5

      48c8a6d100fb89f92a8080697133d77f

    • SHA1

      19c8b82c1164575b88abea63cbff500fd5ec26b7

    • SHA256

      622cc6e79e17696dc0c8a621677765cabe8b48ce5d40881bf71b463223e16364

    • SHA512

      e440057421e96a2ed3043a828ffe9b0738c1c532d9bb63d214e8809a1e2d779e38e2b0cab3f539acac44216753fe7b47f8109e5ec7578873f6efc7a150630549

    • SSDEEP

      3072:Yd9xkHFE9jnOjE8SKfbzxcwg7es6/Vsb8VKTup49oJMfF/H9N3Ky9NzLnj:Y6E9XUhcX7elbKTuq9bfF/H9d9n

    Score
    10/10
    xwormrattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Xworm family

      xworm
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks