Overview

overview

10

Static

static

1

NursultanRelease.zip

windows10-ltsc_2021-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    NursultanRelease.zip
  • Size 275.1MB
  • Sample260308-18385afs7s
  • SHA256 ac9035ad20b84d38687838e50505d51fcdcc4479239d7d8c4464a5cdbc4f77c8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
xwormransomwarerattrojan

Malware Config

Extracted

Family

  • xworm

Version

  • XWorm V6.5 by c3lestial.fun

C2

  • aurmouse-30157.portmap.host:30157

Attributes
  • Install_directory

    %ProgramData%

  • install_file

    svchost.exe

  • telegram

    https://api.telegram.org/bot8385230541:AAEYNcvs9pj5L5W29g9IVW9h7coMJoeDuo8/sendMessage?chat_id=5857293821

Targets

    • Target
      NursultanRelease.zip
    • Size 275.1MB
    • SHA256 ac9035ad20b84d38687838e50505d51fcdcc4479239d7d8c4464a5cdbc4f77c8
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    xwormransomwarerattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Xworm family

      xworm

    • Executes dropped EXE

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1

MITRE ATT&CK Matrix

Tasks