Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

Fixer.bat.exe

windows7-x64

10

Fixer.bat.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Fixer.bat.exe

  • Size

    54KB

  • Sample

    250309-lft3eszls7

  • MD5

    ba3a47f83a30bf2b0de4517ac91ad23e

  • SHA1

    e2deab499b4eb81bc72d35c2dcf69af8085ed830

  • SHA256

    6bf25c68fb1114f57bfc4bd970994d49f2bcd65e1bcdfd63fa471fd4a620b8d9

  • SHA512

    e09b4c16388ec909c28ede208a83401433f9868bdd9240dec8992d55dc0e0ca9d0b9f98d8a7ae50dcf6745028b0053f01a18d1e47fdeb2993a78ec91837fb84e

  • SSDEEP

    1536:NsbDoEP0Z1sS95/ZBzMoqbfm3tpAAOJBf6CF:NsbDhk5/ZBz/qbfBAOJBf68

Score
10/10
xwormrattrojan

Malware Config

Extracted

Family

xworm

C2

23.84.85.170:1738

Attributes
  • Install_directory

    %Userprofile%

Targets

    • Target

      Fixer.bat.exe

    • Size

      54KB

    • MD5

      ba3a47f83a30bf2b0de4517ac91ad23e

    • SHA1

      e2deab499b4eb81bc72d35c2dcf69af8085ed830

    • SHA256

      6bf25c68fb1114f57bfc4bd970994d49f2bcd65e1bcdfd63fa471fd4a620b8d9

    • SHA512

      e09b4c16388ec909c28ede208a83401433f9868bdd9240dec8992d55dc0e0ca9d0b9f98d8a7ae50dcf6745028b0053f01a18d1e47fdeb2993a78ec91837fb84e

    • SSDEEP

      1536:NsbDoEP0Z1sS95/ZBzMoqbfm3tpAAOJBf6CF:NsbDhk5/ZBz/qbfBAOJBf68

    Score
    10/10
    xwormrattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Xworm family

      xworm

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks