General

  • Target

    17413751439c4ba378cae40ec0b16d336027bc571097b178eb0b50338a486f15f083d90b27140.dat-decoded.exe

  • Size

    36KB

  • Sample

    250307-x1j9hawjt8

  • MD5

    833a5d6c1f87d538f8c2d1dd9246820b

  • SHA1

    e991047135706790eb016c9ae2e1f08f63734eee

  • SHA256

    dcc0a45317aa7521800d56e529de326e2d45ecb17082cd9b3f2196a1ec0c60e6

  • SHA512

    2ab801e8b13647a0124d2d644713fb7663f993cf8fca6cbd25e2e74a9bfebcf346bff3d01ebdaa32f7df5b9f14ad4ae45c8f1c1e1a15a7819579782da59c9775

  • SSDEEP

    768:MqQq3QWIdhgbvcFASLKyxbFf9Yc2OMhZ3XPk:MPq3QnbOvMVKyBFf9YVOM/Pk

Score
10/10

Malware Config

Extracted

Family

xworm

Version

5.0

C2

freeetradingzone.duckdns.org:3911

Mutex

LpxI7BBpG4bLELYn

Attributes
  • install_file

    USB.exe

aes.plain

Targets

    • Target

      17413751439c4ba378cae40ec0b16d336027bc571097b178eb0b50338a486f15f083d90b27140.dat-decoded.exe

    • Size

      36KB

    • MD5

      833a5d6c1f87d538f8c2d1dd9246820b

    • SHA1

      e991047135706790eb016c9ae2e1f08f63734eee

    • SHA256

      dcc0a45317aa7521800d56e529de326e2d45ecb17082cd9b3f2196a1ec0c60e6

    • SHA512

      2ab801e8b13647a0124d2d644713fb7663f993cf8fca6cbd25e2e74a9bfebcf346bff3d01ebdaa32f7df5b9f14ad4ae45c8f1c1e1a15a7819579782da59c9775

    • SSDEEP

      768:MqQq3QWIdhgbvcFASLKyxbFf9Yc2OMhZ3XPk:MPq3QnbOvMVKyBFf9YVOM/Pk

    Score
    10/10
    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

    • Xworm family

MITRE ATT&CK Matrix

Tasks