General

  • Target

    checker-cheats.exe

  • Size

    75KB

  • Sample

    250308-nvhztawwav

  • MD5

    04e6de63f885854bc352dcaedf70f687

  • SHA1

    2ab12179885dc57bbf255564012fa8e2b82a3330

  • SHA256

    e7e69559f54ae11b078702201d788c1825a79b8e88a77b1b2fde01c1da1f8b06

  • SHA512

    fe8d496253ceb225c29ed5c3e6074a7d4736fb51b77bee1ee6a118e21f05e461e27462604ff167bc6b468b62a3b6716ebd6cbb1201c9337aac31814661ce0c1c

  • SSDEEP

    1536:WhmZh01sWc3AJNyIcb7bzKoOX64pO3szZiH4+Oz:NhF3AJa3bzvODO802z

Score
10/10

Malware Config

Extracted

Family

xworm

C2

aboltustimoha-43339.portmap.host:43339

Attributes
  • Install_directory

    %Userprofile%

  • install_file

    svchost.exe

Targets

    • Target

      checker-cheats.exe

    • Size

      75KB

    • MD5

      04e6de63f885854bc352dcaedf70f687

    • SHA1

      2ab12179885dc57bbf255564012fa8e2b82a3330

    • SHA256

      e7e69559f54ae11b078702201d788c1825a79b8e88a77b1b2fde01c1da1f8b06

    • SHA512

      fe8d496253ceb225c29ed5c3e6074a7d4736fb51b77bee1ee6a118e21f05e461e27462604ff167bc6b468b62a3b6716ebd6cbb1201c9337aac31814661ce0c1c

    • SSDEEP

      1536:WhmZh01sWc3AJNyIcb7bzKoOX64pO3szZiH4+Oz:NhF3AJa3bzvODO802z

    Score
    10/10
    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

    • Xworm family

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Matrix

Tasks