xworm

General

Target
SPE-2025010-WA001310_pdf.rar
Size 45KB
Sample251029-m98ncafr6y
SHA256 b63dc73acf2e5286097608fb63edea904789e1695e29090da8979e187f7fa4b9
MD5 a90c3f7ef1f94c118ba74c7acfc2612e
SHA1 92f627b197d39c4e34b9ec2c08dc10526a32b603
SHA512 814a96882c59bac2200d3a3c39a55e31444be714d6a0f3a26819f65b299fb0269a2b5e452d938771c30414b41dd32ec7177c8a56fe8f0e8a3be7769bfd64a3c4
SSDEEP 768:4WWHCI7RdiN/Gvz4N5kOAL+fFYZtz2E5tN15CGT/Jn5zxbovm+gT6KlPuOoFC8NX:4WY/b4N5kVLiUR3JLJ5NbSarG3NX
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

xworm

Version

XWorm V6.4

C2

178.16.55.129:6333

Mutex

o6MhfpGjJ5FpV4Wz

Attributes

Install_directory
%AppData%
install_file
XClient.exe
telegram
https://api.telegram.org/bot7409572452:AAGp8Ak5bqZu2IkEdggJaz2mnMYRTkTjv-U/sendMessage?chat_id=6870183115

aes.plain

Targets

- Target
  SPE-2025010-WA001310_pdf/RFQ2025010-WA001310 and Certificate_IMG.bat
- Size 122KB
- SHA256 84bc64c5f0b3e217896ebecb8b6d434d0c8fb4c33aa87125b3b8e2062aa283d5
- MD5 8cde5a08d28c27492154526f4dc3bc41
- SHA1 1fab07e4aca9a0ae42528dfe90ed457b0a70fae9
- SHA512 0b4a788d80184bbb6c40dfc0f52fab0017fa5b362137128f36d0a8867a6f554242a9dfc9409c396edd0def67eb8d83aafc0ab9ae826ccb941d5f8a8e2c3359a7
- SSDEEP 1536:PqFrYfdgSY0KGNPAbFBgb5/JwN6huolgjsjLrPEFUNZ9aM+OUZ0DaR:plKG+bgbzhzlN3sFAZV+rnR
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

execution xworm persistence rat trojan
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Detect Xworm Payload
- Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Xworm family
  xworm
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral1 behavioral2
- Target
  SPE-2025010-WA001310_pdf/RFx Description RRP21-0380 Invited Vendor_IMG.bat
- Size 122KB
- SHA256 84bc64c5f0b3e217896ebecb8b6d434d0c8fb4c33aa87125b3b8e2062aa283d5
- MD5 8cde5a08d28c27492154526f4dc3bc41
- SHA1 1fab07e4aca9a0ae42528dfe90ed457b0a70fae9
- SHA512 0b4a788d80184bbb6c40dfc0f52fab0017fa5b362137128f36d0a8867a6f554242a9dfc9409c396edd0def67eb8d83aafc0ab9ae826ccb941d5f8a8e2c3359a7
- SSDEEP 1536:PqFrYfdgSY0KGNPAbFBgb5/JwN6huolgjsjLrPEFUNZ9aM+OUZ0DaR:plKG+bgbzhzlN3sFAZV+rnR
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

execution xworm persistence rat trojan
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Detect Xworm Payload
- Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Xworm family
  xworm
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral3 behavioral4