Overview

overview

10

Static

static

10

Kunzi/Kunz...er.exe

windows10-ltsc 2021-x64

10

Kunzi/Kunz...er.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Kunzi.rar

  • Size

    42KB

  • Sample

    250308-f67tbasmw7

  • MD5

    b64b6d4604f2853cef225a1f750d8dc2

  • SHA1

    a29a39a05f90348e22ef83b4749b5bfd2243868f

  • SHA256

    cb0c7cc189c3d6e549323887c5baec9cfe91252da69a2aaf3d7dfff07c7f6806

  • SHA512

    037c9ecd08398a2dd6b43d458ec47566b7645761944cdd416942bc4a37caea978dd109f35c15c8acdb2c8018bf126320971f771cdb3437baf0266a561a397bef

  • SSDEEP

    768:WLPecqERMFUzBeN7dAL1X2zJZfMV9vZTNTQVVyLDuqlqdFCJ7pm6XlaphdI:WahLFwBeNgXVBEfauqlqdMScanC

Score
10/10
xwormdiscoveryrattrojan

Malware Config

Extracted

Family

xworm

C2

defined-literary.gl.at.ply.gg:39055

Attributes
  • Install_directory

    %LocalAppData%

Targets

    • Target

      Kunzi/KunziSpoofer.exe

    • Size

      76KB

    • MD5

      5d15d2ea7e1adf32489a73cc4a1b8a6d

    • SHA1

      0a2e7b7f8d67c0ffb2b80d68657baaf1593ca8cd

    • SHA256

      24ef64893177dcdb3b5156143b3d59d95857585508269cdbf24ad831dfad2747

    • SHA512

      f72ee020c560d3d5cc8afc1244022d41557f67b63b16c312324d444c31096fa8362d827960ee32a5da1d9615017b32a8a2f7f30192d894fae431465bd8deb58d

    • SSDEEP

      768:ta0mWhFFObZnFabjsQZzzUN0SHtZ4vXMbwSDgXTDaoba6HJxtqzzO8v38Jh+cag8:tajyj3FzQltZ6cbwvTDo6JyO8vIFaBD

    Score
    10/10
    xwormrattrojandiscovery

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Xworm family

      xworm

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks