xworm | 8d0ffcb69cefff7f66be5248e7714549bdaccab163842a86f8baebf7a341ea5d

General

Target
ps_iY3D5NwRZMLv_1776240671633.ps1
Size 266KB
Sample260427-skgffset3t
SHA256 8d0ffcb69cefff7f66be5248e7714549bdaccab163842a86f8baebf7a341ea5d
MD5 b8660b994e264671f61f1b23507d954b
SHA1 8364d8c19e33c580f6b4acf005015a4c6f2594d6
SHA512 9bcf4a14f088964f83514a0a626ef1641efe55fc5ef6af587fb066c18292e5c565c5b336e56eb3c877f5e4b0941effd4b144104d883f99ad316b3e94cbea836b
SSDEEP 6144:ek9WwTjncCsWK0QTD+LgeX/bajbUgnLHtatvuAWWXO8h:t+CM0Q/4gevejb3Lc1uADXv
TLSH
T11A4423306B2D5FB80648A3A941E6F55917F0381FCD89B6AD6AC25EC28C37DE86F1580C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

xworm

Version

5.0

C2

172.245.244.81:1412

Mutex

QkJeyMye9HuylQnt

Attributes

install_file
USB.exe

aes.plain

Targets

- Target
  ps_iY3D5NwRZMLv_1776240671633.ps1
- Size 266KB
- SHA256 8d0ffcb69cefff7f66be5248e7714549bdaccab163842a86f8baebf7a341ea5d
- MD5 b8660b994e264671f61f1b23507d954b
- SHA1 8364d8c19e33c580f6b4acf005015a4c6f2594d6
- SHA512 9bcf4a14f088964f83514a0a626ef1641efe55fc5ef6af587fb066c18292e5c565c5b336e56eb3c877f5e4b0941effd4b144104d883f99ad316b3e94cbea836b
- SSDEEP 6144:ek9WwTjncCsWK0QTD+LgeX/bajbUgnLHtatvuAWWXO8h:t+CM0Q/4gevejb3Lc1uADXv
- TLSH
  T11A4423306B2D5FB80648A3A941E6F55917F0381FCD89B6AD6AC25EC28C37DE86F1580C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery execution xworm rat trojan
- Detect Xworm Payload
- Family: Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- ConfuserEx .NET packer
  Detects ConfuserEx .NET packer.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detect Xworm Payload

Family: Xworm

Command and Scripting Interpreter: PowerShell

ConfuserEx .NET packer

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2