General

  • Target

    https://bazaar.abuse.ch/download/573b6b682ba79aa17aea93a00e8c9f4b3b8d90f177f219682e879bf15c32c55d

  • Sample

    250416-sh5ehawqx4

Malware Config

Extracted

Family

xworm

Attributes
  • install_file

    MasonUSB.exe

Extracted

Family

latentbot

C2

cryptoghost.zapto.org

Targets

    • Target

      https://bazaar.abuse.ch/download/573b6b682ba79aa17aea93a00e8c9f4b3b8d90f177f219682e879bf15c32c55d

    • Detect Xworm Payload

    • LatentBot

      Modular trojan written in Delphi which has been in-the-wild since 2013.

    • Latentbot family

    • Xworm

      Xworm is a remote access trojan written in C#.

    • Xworm family

    • Executes dropped EXE

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v16

Tasks