Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

payload.exe

windows7-x64

10

payload.exe

windows10-2004-x64

10

payload.exe

windows10-ltsc 2021-x64

10

payload.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    payload.exe

  • Size

    209KB

  • Sample

    250308-zpmxcsslz6

  • MD5

    e737f0619caaa10b2c2c04f88d8c723a

  • SHA1

    81e77cd927098a8974e0ee96e77ed534fb181d85

  • SHA256

    718ed0a3d6f82b36d5da2672c247c094362e616bf7f121756d00dc8a70371ecc

  • SHA512

    1f91990eb0d002984e0963282ee83d16ac158327e55d0bf4a0cc00add261a4173c4f5dec4f857d65469235b6c47f63c6bed9a32d35a3ea0a2839c67e23454cc5

  • SSDEEP

    3072:YV9qW1ZG0hVD+g7HII7qlnsf3zfK484WjOwIpa8:BA8GDv7oI2nQzRQ

Score
10/10
xwormrattrojan

Malware Config

Extracted

Family

xworm

Attributes
  • Install_directory

    %ProgramData%

  • install_file

    USB.exe

  • pastebin_url

    https://pastebin.com/raw/H3wFXmEi

Targets

    • Target

      payload.exe

    • Size

      209KB

    • MD5

      e737f0619caaa10b2c2c04f88d8c723a

    • SHA1

      81e77cd927098a8974e0ee96e77ed534fb181d85

    • SHA256

      718ed0a3d6f82b36d5da2672c247c094362e616bf7f121756d00dc8a70371ecc

    • SHA512

      1f91990eb0d002984e0963282ee83d16ac158327e55d0bf4a0cc00add261a4173c4f5dec4f857d65469235b6c47f63c6bed9a32d35a3ea0a2839c67e23454cc5

    • SSDEEP

      3072:YV9qW1ZG0hVD+g7HII7qlnsf3zfK484WjOwIpa8:BA8GDv7oI2nQzRQ

    Score
    10/10
    xwormrattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Xworm family

      xworm

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2behavioral3behavioral4

MITRE ATT&CK Enterprise v15

Tasks