Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

baaaaaaaaaaa.exe

windows10-2004-x64

10

baaaaaaaaaaa.exe

windows10-ltsc 2021-x64

10

baaaaaaaaaaa.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    baaaaaaaaaaa.exe

  • Size

    116KB

  • Sample

    250309-nqbd6sz1ay

  • MD5

    682e174446b6ffee558f93166eaf6757

  • SHA1

    0eee5b2711fa3fa71785a21c86a6bb4f052c1184

  • SHA256

    06d3eb2a5849c1919ee1c57c9c013ea54c73bb4b60a67ccaaab0350a2635d7e6

  • SHA512

    067b5da0409034d4e094432ee0471ad18e0c3708b8b42190df660e0ad4a0a48b146b522a6fbb613708fc1632c3825673329ecde578a739206a0adb9ddfbdfd3d

  • SSDEEP

    1536:Q8akYh6CIb+fxesWfWywd0luhtUio21cDPYhos7Gf5ACLIgq943uxH8irFv2TLMv:QP3ffNJ2Wdvc/w

Score
10/10
xwormrattrojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

any-attraction.gl.at.ply.gg:27770

Mutex

hgwBs8FhWODiPVMb

Attributes
  • Install_directory

    %AppData%

  • install_file

    USB.exe

aes.plain

Targets

    • Target

      baaaaaaaaaaa.exe

    • Size

      116KB

    • MD5

      682e174446b6ffee558f93166eaf6757

    • SHA1

      0eee5b2711fa3fa71785a21c86a6bb4f052c1184

    • SHA256

      06d3eb2a5849c1919ee1c57c9c013ea54c73bb4b60a67ccaaab0350a2635d7e6

    • SHA512

      067b5da0409034d4e094432ee0471ad18e0c3708b8b42190df660e0ad4a0a48b146b522a6fbb613708fc1632c3825673329ecde578a739206a0adb9ddfbdfd3d

    • SSDEEP

      1536:Q8akYh6CIb+fxesWfWywd0luhtUio21cDPYhos7Gf5ACLIgq943uxH8irFv2TLMv:QP3ffNJ2Wdvc/w

    Score
    10/10
    xwormrattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Xworm family

      xworm
    behavioral1behavioral2behavioral3

MITRE ATT&CK Matrix

Tasks