General

  • Target
    MTASA_SPOOFER__SERIAL_CHANGER_V1.0.rar
  • Size 16KB
  • Sample250803-lpmppsck6w
  • SHA256 ddc8492f4d044b6d7fbbbdb3c705b2847503ed47a7bf2665dec46ab6ed508152
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • xworm

Version
  • 5.0

C2
  • monstr.ddns.net:1177

Mutex
  • hrrlp3UG4oHVSl9q

Attributes
  • Install_directory

    %AppData%

  • install_file

    RuntimeBroker.exe

aes.plain

Targets

    • Target
      MTASA_SPOOFER__SERIAL_CHANGER_V1.0.rar
    • Size 16KB
    • SHA256 ddc8492f4d044b6d7fbbbdb3c705b2847503ed47a7bf2665dec46ab6ed508152
    • MD5 SHA1 SHA512 SSDEEP
    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

    • Xworm family

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

    • Target
      MTASA SPOOFER SERIAL CHANGER V1.0/aZSYX0s1qnq4y7R.exe
    • Size 34KB
    • SHA256 4380d2bbe9f643e4cb096c64e63a743d58d655ba4a93993128ff56ed0babe265
    • MD5 SHA1 SHA512 SSDEEP
    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

    • Xworm family

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v16

Tasks