xworm

General

Target
SKM_C300i2510201438065959565985959595959_65535656535.PDF.exe
Size 527KB
Sample251021-e2scdse12b
SHA256 2cd68c73f407a88d29c7599a427f747f4f686dd12c33be96589d49f2f879d080
MD5 e8bd1d4b441205ec2116e1acea654eca
SHA1 3f45a4787f77e43f9c609fbe0a34600242361dac
SHA512 696fee45cef31cb58549891fbf827470f7fd53e7da487612d69c89e64fe484faa2b4595ca790567578864b9183768e4c1e412489d3601610721e31925507c552
SSDEEP 12288:xBBf7+ny1Ouo0k1C++9RBiejeMtiaFgTn:xvf75DoNDqb9uL
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

xworm

Version

5.0

C2

104.250.180.178:7061

Mutex

nad1XgX6V6D7Ls0K

Attributes

Install_directory
%AppData%
install_file
XWormClient.exe

aes.plain

Targets

- Target
  SKM_C300i2510201438065959565985959595959_65535656535.PDF.exe
- Size 527KB
- SHA256 2cd68c73f407a88d29c7599a427f747f4f686dd12c33be96589d49f2f879d080
- MD5 e8bd1d4b441205ec2116e1acea654eca
- SHA1 3f45a4787f77e43f9c609fbe0a34600242361dac
- SHA512 696fee45cef31cb58549891fbf827470f7fd53e7da487612d69c89e64fe484faa2b4595ca790567578864b9183768e4c1e412489d3601610721e31925507c552
- SSDEEP 12288:xBBf7+ny1Ouo0k1C++9RBiejeMtiaFgTn:xvf75DoNDqb9uL
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

discovery xworm rat trojan
- Detect Xworm Payload
- Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Xworm family
  xworm
- Drops startup file
- SmartAssembly .NET packer
  Detects SmartAssembly .NET packer.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detect Xworm Payload

Xworm family

Drops startup file

SmartAssembly .NET packer

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2