xworm

General

Target

cf_verif.ps1
Size

679B
Sample

250307-sj5rnassav
MD5

1b50d8010aab1860d73255e7857197b6
SHA1

960be1f5e7d05216ce2a1fd8012a7434e1d9c47e
SHA256

b18ed93dd979c6233b1ce6e195338a57243f2a71e6147311aaf06fccea1d20c7
SHA512

af037b5aeb04a96f9af623b3a96baa76ea6b62792a7552cbf5ee7f9ad18f09b0085b8874c1a46ffbc710bca6bc6d2105a70196028fb76bf781b652433c212c40

Score

10^/10

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://cf-prod-cap.cfd/aliu1.ps1

Extracted

Family

xworm

Version

5.0

C2

193.32.177.63:6000

Mutex

wwD0bshguVCRSd3k

Attributes

install_file
USB.exe
telegram
https://api.telegram.org/bot7238632531:AAGCQZAh03hAwOcuP9HUeoAP5AQV0o0tp24/sendMessage?chat_id=8080837794

aes.plain

Targets

- Target
  
  cf_verif.ps1
- Size
  
  679B
- MD5
  
  1b50d8010aab1860d73255e7857197b6
- SHA1
  
  960be1f5e7d05216ce2a1fd8012a7434e1d9c47e
- SHA256
  
  b18ed93dd979c6233b1ce6e195338a57243f2a71e6147311aaf06fccea1d20c7
- SHA512
  
  af037b5aeb04a96f9af623b3a96baa76ea6b62792a7552cbf5ee7f9ad18f09b0085b8874c1a46ffbc710bca6bc6d2105a70196028fb76bf781b652433c212c40
Score

10^/10

execution xworm rat trojan
- Detect Xworm Payload
- Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Xworm family
  xworm
- Blocklisted process makes network request
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Detect Xworm Payload

Xworm family

Blocklisted process makes network request

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2