Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

justDOIT.exe

windows7-x64

10

justDOIT.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    justDOIT.exe

  • Size

    62KB

  • Sample

    250309-qz3k5asses

  • MD5

    35e5280c8dc2c7e86c79c4e7f38b15b3

  • SHA1

    e311343c16334a8e0aaa301733cf951e5cd948d6

  • SHA256

    3cfacf4f838a6bdcd48192e33526b940d5f25e639fa2ce080c0fc48666b8d923

  • SHA512

    897e5620c36438e888ff1bd6b20d8e1a0880dcd6cf28677e6bb7d1a51e4b81b8cd06a392988f3b0afdfce03d38abaa8ad2981dbc76380cdd2c7d2cedd004476a

  • SSDEEP

    1536:5NetXvm1lQ6ou3hlbO8lFcNaYwsbw4WEFR+OToCi:be/6oqhlagXsbw432OTof

Score
10/10
xwormrattrojan

Malware Config

Extracted

Family

xworm

C2

23.84.85.170:1738

127.0.0.1:1738
Attributes
  • Install_directory

    %Temp%

Targets

    • Target

      justDOIT.exe

    • Size

      62KB

    • MD5

      35e5280c8dc2c7e86c79c4e7f38b15b3

    • SHA1

      e311343c16334a8e0aaa301733cf951e5cd948d6

    • SHA256

      3cfacf4f838a6bdcd48192e33526b940d5f25e639fa2ce080c0fc48666b8d923

    • SHA512

      897e5620c36438e888ff1bd6b20d8e1a0880dcd6cf28677e6bb7d1a51e4b81b8cd06a392988f3b0afdfce03d38abaa8ad2981dbc76380cdd2c7d2cedd004476a

    • SSDEEP

      1536:5NetXvm1lQ6ou3hlbO8lFcNaYwsbw4WEFR+OToCi:be/6oqhlagXsbw432OTof

    Score
    10/10
    xwormrattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Xworm family

      xworm

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks