Overview

overview

10

Static

static

3

blah2.exe

windows7-x64

10

blah2.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    blah2.exe

  • Size

    106KB

  • Sample

    250307-txtrzss1fw

  • MD5

    2837c6696df8a6a101567312047698b7

  • SHA1

    a8e9d668851a33c2d33598052264bb2a91b1201e

  • SHA256

    7fa538a1235f7d537b42c0efabea57cfce678dbaeab881057a54ef5035336cf7

  • SHA512

    5560e319f6bd2fd594747cc1df801112efcc57a81397f30be821ced0db8f1e035c56795feeec961d4aedc8de9b6b5cd5b0e143e226faa78bd2d1f762bae85142

  • SSDEEP

    3072:tqcOyQUp43EBkYLGw2mZJ/yjgf6yFOBM:8cOI9LGwrJqm6ysB

Score
10/10
xwormpersistencerattrojan

Malware Config

Targets

    • Target

      blah2.exe

    • Size

      106KB

    • MD5

      2837c6696df8a6a101567312047698b7

    • SHA1

      a8e9d668851a33c2d33598052264bb2a91b1201e

    • SHA256

      7fa538a1235f7d537b42c0efabea57cfce678dbaeab881057a54ef5035336cf7

    • SHA512

      5560e319f6bd2fd594747cc1df801112efcc57a81397f30be821ced0db8f1e035c56795feeec961d4aedc8de9b6b5cd5b0e143e226faa78bd2d1f762bae85142

    • SSDEEP

      3072:tqcOyQUp43EBkYLGw2mZJ/yjgf6yFOBM:8cOI9LGwrJqm6ysB

    Score
    10/10
    xwormpersistencerattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Xworm family

      xworm

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks