General

  • Target

    OCYMF_XClient.exe

  • Size

    197KB

  • Sample

    250306-semqaa1vdv

  • MD5

    947531e390d56a33db1c5fac201f3d6e

  • SHA1

    6890af0bf097ca3dbf3a979251e8e9655a0d28c9

  • SHA256

    e98dc3272849a4feef91b79b5f4ceb5a5caeeb67c0ace7b951e719e4c56dc4b9

  • SHA512

    36c81a7b5ad59952e0e084df7601e14e2f4ac5530dd2937ab90f7f7693297f9776f6e970905f35cf058b76d5c3a465a112276d6426fe6527b8596504292df3e0

  • SSDEEP

    3072:Qd9KkHFE9jNOjn8SKfbzxcwg7es6/Vsb8VKTup49oJMfF/H9N3Ky9NzLnK:QrE92UhcX7elbKTuq9bfF/H9d9n

Score
10/10

Malware Config

Extracted

Family

xworm

Version

5.0

C2

ohsorry-20836.portmap.host:20836

Mutex

p0RlYlnzEbgzdE3a

Attributes
  • install_file

    USB.exe

aes.plain

Targets

    • Target

      OCYMF_XClient.exe

    • Size

      197KB

    • MD5

      947531e390d56a33db1c5fac201f3d6e

    • SHA1

      6890af0bf097ca3dbf3a979251e8e9655a0d28c9

    • SHA256

      e98dc3272849a4feef91b79b5f4ceb5a5caeeb67c0ace7b951e719e4c56dc4b9

    • SHA512

      36c81a7b5ad59952e0e084df7601e14e2f4ac5530dd2937ab90f7f7693297f9776f6e970905f35cf058b76d5c3a465a112276d6426fe6527b8596504292df3e0

    • SSDEEP

      3072:Qd9KkHFE9jNOjn8SKfbzxcwg7es6/Vsb8VKTup49oJMfF/H9N3Ky9NzLnK:QrE92UhcX7elbKTuq9bfF/H9d9n

    Score
    10/10
    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

    • Xworm family

MITRE ATT&CK Matrix

Tasks