Overview

overview

10

Static

static

3

QUOTATION_...B).exe

windows10-2004-x64

10

QUOTATION_...B).exe

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    RFQ# QUOTATION _ PO-20260602-7701663 __ E2S A105N - PROCUREMENT-password(bCVCn4xq).zip
  • Size 1.5MB
  • Sample260603-aleddagy6n
  • SHA256 817ca49cd7df9575bc33712fa71fa6d0d2b32050f5f04d17c7ae042c3029c366
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
xwormdiscoverypersistencerattrojan

Malware Config

Targets

    • Target
      QUOTATION_#PO-20260602-7701663 E2S A105N.pdf(783KB).exe
    • Size 1.1MB
    • SHA256 8ac1b7a926bb396cee28bc1fa36f91bf7687c19be5a9a304451efb16a06ce3dd
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    discoveryxwormpersistencerattrojan

    • Detect Xworm Payload

    • Family: Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks