Overview

overview

10

Static

static

10

www.exe

windows7-x64

10

www.exe

windows7-x64

10

www.exe

windows10-2004-x64

10

www.exe

windows10-ltsc 2021-x64

10

www.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    www.exe

  • Size

    30KB

  • Sample

    250306-w6gvwsvtfx

  • MD5

    d8a05fae946f16dbb12d5489f2b68230

  • SHA1

    f8068ceb85905539ed39dc4dc187088487b09e17

  • SHA256

    7876b3d0721a40d4d80f873be9ff79e722e28bd24ba0ee9ab9faac5c7aa69899

  • SHA512

    661fc778e40c260756d928fe3bed91c3cbc8884ac27a071e1bf3c8f97c9133bd4bd853371baed477a3988305c12e1c405d03059f8652d810a23eb6050f6ade77

  • SSDEEP

    768:fJCIMRhP3BMYAoR/iw2uBFE9RbOqhvbT:hCv/piw24FE9RbOqVH

Score
10/10
xwormrattrojan

Malware Config

Extracted

Family

xworm

Version

3.1

C2

association-lectures.gl.at.ply.gg:32463

Mutex

GtBBhRsUSMWqKscn

Attributes
  • install_file

    USB.exe

aes.plain

Targets

    • Target

      www.exe

    • Size

      30KB

    • MD5

      d8a05fae946f16dbb12d5489f2b68230

    • SHA1

      f8068ceb85905539ed39dc4dc187088487b09e17

    • SHA256

      7876b3d0721a40d4d80f873be9ff79e722e28bd24ba0ee9ab9faac5c7aa69899

    • SHA512

      661fc778e40c260756d928fe3bed91c3cbc8884ac27a071e1bf3c8f97c9133bd4bd853371baed477a3988305c12e1c405d03059f8652d810a23eb6050f6ade77

    • SSDEEP

      768:fJCIMRhP3BMYAoR/iw2uBFE9RbOqhvbT:hCv/piw24FE9RbOqVH

    Score
    10/10
    xwormrattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Xworm family

      xworm
    behavioral1behavioral2behavioral3behavioral4behavioral5

MITRE ATT&CK Matrix

Tasks