xworm

General

Target
STXF-COMMOSA_QUOTATION.....2025.exe
Size 679KB
Sample251201-ry87ysyqcs
SHA256 73641a6dd5f95201524760fb4b5e951dba1fa239bce351d6e765021ab08de01f
MD5 16802eeb2eff09b84fc7c6c491105f85
SHA1 4c7de2517bf37b7d88c08326813beba0f48d65dd
SHA512 a4e35501e222285e341cb2e51475839fb47b6ff4e8e97aa4c19b81a55d15051b26daa61716fd3a0ef097a2549c639ef03f2d44933f3c0754a155ee29fe02ae90
SSDEEP 12288:ItrXdFIjNF1rfQ9vpF2cCCDPsvGMgNwz+0fSBvLU:nF1rI9hNCAPsv6+ivo
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

xworm

C2

petro4prime.ydns.eu:5909

Attributes

Install_directory
%AppData%
install_file
OneNote.exe

Targets

- Target
  STXF-COMMOSA_QUOTATION.....2025.exe
- Size 679KB
- SHA256 73641a6dd5f95201524760fb4b5e951dba1fa239bce351d6e765021ab08de01f
- MD5 16802eeb2eff09b84fc7c6c491105f85
- SHA1 4c7de2517bf37b7d88c08326813beba0f48d65dd
- SHA512 a4e35501e222285e341cb2e51475839fb47b6ff4e8e97aa4c19b81a55d15051b26daa61716fd3a0ef097a2549c639ef03f2d44933f3c0754a155ee29fe02ae90
- SSDEEP 12288:ItrXdFIjNF1rfQ9vpF2cCCDPsvGMgNwz+0fSBvLU:nF1rI9hNCAPsv6+ivo
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

discovery xworm rat trojan
- Detect Xworm Payload
- Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Xworm family
  xworm
- .NET Reactor proctector
  Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Drops startup file
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detect Xworm Payload

Xworm family

.NET Reactor proctector

Drops startup file

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2