Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

svchost.exe

windows11-21h2-x64

10

Resubmissions

09/03/2025, 12:20

250309-ph1jrs1k17 10

09/03/2025, 12:17

250309-pgg12a1ky8 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    svchost.exe

  • Size

    58KB

  • Sample

    250309-pgg12a1ky8

  • MD5

    2b42433cc8d3450d015d04a3c8662558

  • SHA1

    0932042702ed80152a37c564aeb2114dc48dd3af

  • SHA256

    075151678431e9ed1a6f26563f7a2143517bec7741c6dc53a106fbad4fe2d41a

  • SHA512

    880a4975cf19cd5ee71a4385f5ec786018d3416addb5a3f21a863614c85490521ccbffab762f2dbc04b2873d53b9e9d5c8dd34fa4b1892bd76a057c9e61db254

  • SSDEEP

    1536:WWsAalSKXHuSQRh5FgrbsN/+zn/QbOXTP:WWsAawK3+5FIbsMz/QbOr

Score
10/10
xwormrattrojan

Malware Config

Extracted

Family

xworm

Attributes
  • install_file

    USB.exe

Targets

    • Target

      svchost.exe

    • Size

      58KB

    • MD5

      2b42433cc8d3450d015d04a3c8662558

    • SHA1

      0932042702ed80152a37c564aeb2114dc48dd3af

    • SHA256

      075151678431e9ed1a6f26563f7a2143517bec7741c6dc53a106fbad4fe2d41a

    • SHA512

      880a4975cf19cd5ee71a4385f5ec786018d3416addb5a3f21a863614c85490521ccbffab762f2dbc04b2873d53b9e9d5c8dd34fa4b1892bd76a057c9e61db254

    • SSDEEP

      1536:WWsAalSKXHuSQRh5FgrbsN/+zn/QbOXTP:WWsAawK3+5FIbsMz/QbOr

    Score
    10/10
    xwormrattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Xworm family

      xworm

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1

MITRE ATT&CK Matrix

Tasks