Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

payload_extracted.exe

windows7-x64

10

payload_extracted.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    payload_extracted.exe

  • Size

    1.2MB

  • Sample

    250308-xnf2ba1tg1

  • MD5

    a3e9edbeda9202428162ce51852d0e78

  • SHA1

    7a75214465bad1050098d3f2feb5fd918fa4d13d

  • SHA256

    8f5b86e72ab98c41c660aee0c529d430e82172ddaa4fb80821392a4eab729b9b

  • SHA512

    d8a70a0833ddf0b190429f58f3fe5de9747a1ee88abfc5b05e7861c59d39d2ec1d8f204cb87573a65657de42d0b544f02ebe85de77fde380b11a6dec36288e14

  • SSDEEP

    24576:teVrNptvf/9VgJi7TixdrkPzAlxJyfb+3edbG18TldOKFjSqweA4:EVp/Hsi7TG4rAlxJyi3abG1ClrGqnx

Score
10/10
xwormdiscoveryrattrojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

meowycatty.ddns.net:8843

Mutex

0E4VwJ2aWKHLu9kc

Attributes
  • install_file

    USB.exe

aes.plain

Targets

    • Target

      payload_extracted.exe

    • Size

      1.2MB

    • MD5

      a3e9edbeda9202428162ce51852d0e78

    • SHA1

      7a75214465bad1050098d3f2feb5fd918fa4d13d

    • SHA256

      8f5b86e72ab98c41c660aee0c529d430e82172ddaa4fb80821392a4eab729b9b

    • SHA512

      d8a70a0833ddf0b190429f58f3fe5de9747a1ee88abfc5b05e7861c59d39d2ec1d8f204cb87573a65657de42d0b544f02ebe85de77fde380b11a6dec36288e14

    • SSDEEP

      24576:teVrNptvf/9VgJi7TixdrkPzAlxJyfb+3edbG18TldOKFjSqweA4:EVp/Hsi7TG4rAlxJyi3abG1ClrGqnx

    Score
    10/10
    xwormdiscoveryrattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Xworm family

      xworm
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks