Overview

overview

10

Static

static

10

Steam.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Steam.exe

  • Size

    141KB

  • Sample

    250308-m6al5swsdt

  • MD5

    c6b6f2505d47e4cd1dce947af878f580

  • SHA1

    e0bbebebbd86c49b3a1ed9268abccbd7f4add970

  • SHA256

    d12964541a2b7f18d1aa235a1725cdf2606269c7f6f97c55e92fc480710a82f4

  • SHA512

    4480b20fe058d10e6fbc8ac88e7f0b1e6b6804c5a1ddc6a84b5409c75d21f164ddcaee0fa0c711ae276dd10c21066c214821d31fa85684c4db4237a20f5dc0b8

  • SSDEEP

    3072:QWQPZXJxqvwVb9LFH4vO8En6ZZZj7Iq+gJTefr:GPnxOwVbANHnh+g

Score
10/10
xwormrattrojan

Malware Config

Extracted

Family

xworm

C2

some-event.gl.at.ply.gg:47661

Attributes
  • Install_directory

    %AppData%

  • install_file

    USB.exe

Targets

    • Target

      Steam.exe

    • Size

      141KB

    • MD5

      c6b6f2505d47e4cd1dce947af878f580

    • SHA1

      e0bbebebbd86c49b3a1ed9268abccbd7f4add970

    • SHA256

      d12964541a2b7f18d1aa235a1725cdf2606269c7f6f97c55e92fc480710a82f4

    • SHA512

      4480b20fe058d10e6fbc8ac88e7f0b1e6b6804c5a1ddc6a84b5409c75d21f164ddcaee0fa0c711ae276dd10c21066c214821d31fa85684c4db4237a20f5dc0b8

    • SSDEEP

      3072:QWQPZXJxqvwVb9LFH4vO8En6ZZZj7Iq+gJTefr:GPnxOwVbANHnh+g

    Score
    10/10
    xwormrattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Xworm family

      xworm

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1

MITRE ATT&CK Matrix

Tasks