Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

asdss.exe

windows7-x64

10

asdss.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    asdss.exe

  • Size

    63KB

  • Sample

    250309-nbt8qszqz3

  • MD5

    1e267f344fe951420942bb18e7fa1647

  • SHA1

    82ff8312c2b1affdc33cb9bf5adc90ac66398384

  • SHA256

    8ed527eb690af8d62a8b8c7e79391c25d6dfa10af0559e64d8dea007f06c2043

  • SHA512

    9162ec974d2f0573052739e5dbcfa5e74ea0d293ce7348f6568304b23f13896b2748d3e214407d12f66204959956641edc53bc7acb2d281d7e65cdd68e44b48d

  • SSDEEP

    1536:LrSMeEbCVU7TFEwHblCBY6mhLOasO38DCa:vSna7Tpblg8sO38Df

Score
10/10
xwormrattrojan

Malware Config

Extracted

Family

xworm

C2

23.84.85.170:1738

Attributes
  • Install_directory

    %AppData%

Targets

    • Target

      asdss.exe

    • Size

      63KB

    • MD5

      1e267f344fe951420942bb18e7fa1647

    • SHA1

      82ff8312c2b1affdc33cb9bf5adc90ac66398384

    • SHA256

      8ed527eb690af8d62a8b8c7e79391c25d6dfa10af0559e64d8dea007f06c2043

    • SHA512

      9162ec974d2f0573052739e5dbcfa5e74ea0d293ce7348f6568304b23f13896b2748d3e214407d12f66204959956641edc53bc7acb2d281d7e65cdd68e44b48d

    • SSDEEP

      1536:LrSMeEbCVU7TFEwHblCBY6mhLOasO38DCa:vSna7Tpblg8sO38Df

    Score
    10/10
    xwormrattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Xworm family

      xworm

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks