xworm | c3b91a11976ecafbbf95430bc492aecdc71970372ef265a4282728b7eb74a492

General

Target
OC463971.exe
Size 747KB
Sample260413-pj7pgafy3v
SHA256 c3b91a11976ecafbbf95430bc492aecdc71970372ef265a4282728b7eb74a492
MD5 7030675aae6135ae1c973cd7c7009db4
SHA1 881ba6b102f5a30063d6bc44c9c794f2d04ae1aa
SHA512 79fc656617409da09abf199834360cf72b7c293ec83964bc415695afb84e49a8e41db70df6019392bcf056cb3d82e5d3b75f70d424d4e31164247b876fc5482a
SSDEEP 12288:bjJQC3Q19YD86FdgeK9bY6wNs5LMrNSWFhIzu6:bFZ3sYDIeKXOs54rNSSIr
TLSH
T1C7F4C0166F462B17C57EDBBCD4338058A3F08B07A3DAD3976EED50E506967C6C9222C2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

xworm

C2

petro4prime.ydns.eu:5909

Attributes

Install_directory
%AppData%
install_file
PowerPoint.exe

Targets

- Target
  OC463971.exe
- Size 747KB
- SHA256 c3b91a11976ecafbbf95430bc492aecdc71970372ef265a4282728b7eb74a492
- MD5 7030675aae6135ae1c973cd7c7009db4
- SHA1 881ba6b102f5a30063d6bc44c9c794f2d04ae1aa
- SHA512 79fc656617409da09abf199834360cf72b7c293ec83964bc415695afb84e49a8e41db70df6019392bcf056cb3d82e5d3b75f70d424d4e31164247b876fc5482a
- SSDEEP 12288:bjJQC3Q19YD86FdgeK9bY6wNs5LMrNSWFhIzu6:bFZ3sYDIeKXOs54rNSSIr
- TLSH
  T1C7F4C0166F462B17C57EDBBCD4338058A3F08B07A3DAD3976EED50E506967C6C9222C2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery xworm rat trojan
- Detect Xworm Payload
- Family: Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- .NET Reactor proctector
  Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Drops startup file
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detect Xworm Payload

Family: Xworm

.NET Reactor proctector

Drops startup file

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2