xworm

General

Target
Grey Spoofer.rar
Size 2.5MB
Sample250720-pkafcszzet
SHA256 5847451fe92ade8277599206f2d3ec904eef8e396bb5a6a6c988912e579dfacf
MD5 2b90cec4759e9f86c509c9c41055aaa0
SHA1 c0d09779ecf4f222b8a3bbc95769099bc73c1b8c
SHA512 8987e7ab5521f6b67b8ecb18cbd10b5419609d68242ce9cdd6283aa919dd1a68e2649e340e6bb188781e6de506192e26afabac4fa8f70209ddd37234869fc91d
SSDEEP 49152:omSxIMm1XK8VIWzPLaOPQPJIs8RU45V13Ul1AC5FO6rGIAkXJaBofyq3BY3noF+4:oHqMm1XK8VI8aOkh8a+V1El1AC5FO6HP
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

xworm

Version

5.0

C2

127.0.0.1:7000
troia23.ddns.net:7000
troia23.duckdns.org:7000

Mutex

JFV6WneVQNELjP8A

Attributes

install_file
bootmgr.exe

aes.plain

Targets

- Target
  Grey Spoofer/Grey Spoofer.bat
- Size 2.9MB
- SHA256 b4bf087bdd0c8a6ed7fba9be38b8de366d10bdb158d84200707e534fa007172d
- MD5 7dcc87628bb7afaa189f653dd1fe2f37
- SHA1 f4fa42b50217a3c5c484ede5c4b41fa0b65ee573
- SHA512 3ce8b93c243d684846c64f706c7f5ff954d8436c398fcd27da401bb1b5553fc8b878d5408a2568e4453b8950eb6a8ea88106760ab7859967c9acaed33b51a0a5
- SSDEEP 24576:VMkmMN6caU80VAwCxHrWIDlCNMe/81g7kr/LHYGCPVGuVbMVhzMGhQUcjJ+L88su:arcYDlCespDVcheoW7lJXECU
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

xworm execution rat trojan
- Detect Xworm Payload
- Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Xworm family
  xworm
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Executes dropped EXE
behavioral1
- Target
  Grey Spoofer/obsidium64.dll
- Size 312KB
- SHA256 6d8361489584a1d7f657d5c62b3d5ecc5c4277eb22304dc8557597cd5e494fab
- MD5 04309f41d97720db02726c018f2c885f
- SHA1 1dce4a32292f1bf5d0de9eb906ae1dba9bc247a8
- SHA512 355727bedbd8b1041ee963f48d9567609521e83a53822b53495310e900df52a39c5530725ceb1f9622eeb9b202d80bd3202e753a9d8fa0c00873fe0282472906
- SSDEEP 6144:cd/WbSly6M50creIhrx0nOWK52d5B7GFQkQcF2DYhftO26N7IsL0V:QZ46M5NPt0OWK5K51GQkNhfA26N7rQV
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral2
- Target
  batch_interpreter.py
- Size 32KB
- SHA256 4b6b08f8639487b0f69788419f404a2f60b8f3f4327fef928f2fbefeb14c6be4
- MD5 0da4aeafc919996d9221df4a5750f6eb
- SHA1 feef7d942ddb9659175f47dfad77cd909abc0b23
- SHA512 0a5e2bbdeb2778469b5fa2b21a298ca6392783b4cd822a9f2cb3af454023fbfaa2a2517e556ef1bd900475a2e73afd71cdea9dca40681f093b04c5b74af010ac
- SSDEEP 768:9PdsvDKnuqmiZFHFXohle4DrJr41HKKzQ5d:JfVuLh41HJC
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral3

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Extracted

Targets

Detect Xworm Payload

Xworm family

Blocklisted process makes network request

Command and Scripting Interpreter: PowerShell

Executes dropped EXE

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3