Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

dddddddddd...dd.exe

windows7-x64

10

dddddddddd...dd.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    dddddddddddddddddddddddddddddddddddddddddddddd.exe

  • Size

    66KB

  • Sample

    250308-3hhwlsvjy5

  • MD5

    8baabd2d13aad2042c53812049e3d513

  • SHA1

    dbe003cfb4e6d4d1ff321e41a8b9af8070ef0dbc

  • SHA256

    658eee587548b0fd38329eb2846cb9329bcd086d8c15f3f21205c5611348e748

  • SHA512

    d4c02d912474dfe01d7302ee41ce5756d18ad2f0a80940f5c4b24c0f0e2f531dd27261f8e674389f1425c1adec6432ec049cdde43fdd30a1a413d91f9528ba72

  • SSDEEP

    1536:hMVcl7LToT6KohtQjUEhf1yG9ObBBTuBNnOBakjebIO1ouuhjdgo:eVQcT6KooHwbLWn8CbIO1ouupqo

Score
10/10
xwormrattrojan

Malware Config

Extracted

Family

xworm

C2

homes-customized.gl.at.ply.gg:49855

Attributes
  • Install_directory

    %AppData%

  • install_file

    XClient.exe

Targets

    • Target

      dddddddddddddddddddddddddddddddddddddddddddddd.exe

    • Size

      66KB

    • MD5

      8baabd2d13aad2042c53812049e3d513

    • SHA1

      dbe003cfb4e6d4d1ff321e41a8b9af8070ef0dbc

    • SHA256

      658eee587548b0fd38329eb2846cb9329bcd086d8c15f3f21205c5611348e748

    • SHA512

      d4c02d912474dfe01d7302ee41ce5756d18ad2f0a80940f5c4b24c0f0e2f531dd27261f8e674389f1425c1adec6432ec049cdde43fdd30a1a413d91f9528ba72

    • SSDEEP

      1536:hMVcl7LToT6KohtQjUEhf1yG9ObBBTuBNnOBakjebIO1ouuhjdgo:eVQcT6KooHwbLWn8CbIO1ouupqo

    Score
    10/10
    xwormrattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Xworm family

      xworm

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks