xworm | d56bd06a68d33a1d07b75d1caec577a592dc7ea893d34153746b0d4cec21de58

General

Target
COTIZACION.exe
Size 875KB
Sample260616-n69a5sdw2w
SHA256 d56bd06a68d33a1d07b75d1caec577a592dc7ea893d34153746b0d4cec21de58
MD5 bdf08ce9ab6f348e47f6e8af26af4a65
SHA1 d3919b114fc4e131f769b154db6b6c0b0b8b569b
SHA512 62230408290fab0d609cda1b4bc40053bd70992a091697166792165fbf8a27e050344fdf5494b60008b2fef6abbf7cbb097cfe227c4ff1cd20fbb4e0bb5815f5
SSDEEP 12288:ReMW7L/o2adwlzKi3E13hsBEhijE8wpVlSW/CKR15XpN9F5vBAp:ReMW7z2Klb0HsBsxpbrqKR1N9F/A
TLSH
T1D315C0386DC68549C6784FB5C6739B8837F1D94BDBC2D30B7FDA20A8892E796C500E16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

xworm

C2

petro4prime.ydns.eu:5909

Attributes

Install_directory
%AppData%
install_file
PowerPoint.exe

Targets

- Target
  COTIZACION.exe
- Size 875KB
- SHA256 d56bd06a68d33a1d07b75d1caec577a592dc7ea893d34153746b0d4cec21de58
- MD5 bdf08ce9ab6f348e47f6e8af26af4a65
- SHA1 d3919b114fc4e131f769b154db6b6c0b0b8b569b
- SHA512 62230408290fab0d609cda1b4bc40053bd70992a091697166792165fbf8a27e050344fdf5494b60008b2fef6abbf7cbb097cfe227c4ff1cd20fbb4e0bb5815f5
- SSDEEP 12288:ReMW7L/o2adwlzKi3E13hsBEhijE8wpVlSW/CKR15XpN9F5vBAp:ReMW7z2Klb0HsBsxpbrqKR1N9F/A
- TLSH
  T1D315C0386DC68549C6784FB5C6739B8837F1D94BDBC2D30B7FDA20A8892E796C500E16
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery xworm rat trojan
- Detect Xworm Payload
- Family: Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- .NET Reactor proctector
  Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Drops startup file
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detect Xworm Payload

Family: Xworm

.NET Reactor proctector

Drops startup file

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2