xworm | 6214366a2e27317342873589a694a9b770c378329c0b38ea83b38a9d1552110c

General

Target
s2.zip
Size 602KB
Sample260620-mkb8vafw4s
SHA256 6214366a2e27317342873589a694a9b770c378329c0b38ea83b38a9d1552110c
MD5 e15fcd6a8044a252c4cc0409f0382ff3
SHA1 a89170eeceb7d9aec6204698c03807218438ad3d
SHA512 e8ccb7751794162d3c6bf99b142ff8a781e0399c661746e51a80440b4c8af3884e702168e0be259df2b0eb588b768ced2fe32f80be153d8b8252a7dbb32468ec
SSDEEP 12288:4zZnFeTgriDewPP5U1gIvfl6FPdFaBuP7Zd+aBVw4/IMv1gNDl++ew4BkSeiK:49n0sriTPPOJN2F4BuPP+aBRIMv2NZV5
TLSH
T1FAD4232B1274CBB45C61503B3944745E8727DB826E8F9AB2F84C680A436C7FD5698DF3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

xworm

C2

petro4prime.ydns.eu:5909

Attributes

Install_directory
%AppData%
install_file
PowerPoint.exe

Targets

- Target
  a951afc09aa3e8be61204a027c2cc0c141a64792a2022b8d6ebdf8e0e54a2279.exe
- Size 870KB
- SHA256 a951afc09aa3e8be61204a027c2cc0c141a64792a2022b8d6ebdf8e0e54a2279
- MD5 8404ae737e2cf0dd72b36c9cede37a9f
- SHA1 bde47864dd96a3108434ef675008716b9198854b
- SHA512 77b55bde78ab9d509f86e93f6cc94356b9702b5f5ad3dd34098b02d8d9fcdd424a6e01364cea5cb16eef2bc901492e8bcb0d564e3d649fecc9591708b1e6651e
- SSDEEP 12288:vs6JjKlzKi3E13hsBEhijE8wpVlSW/CKR15XpN9w5qNx+j:06Ilb0HsBsxpbrqKR1N9w
- TLSH
  T1E615CF283DC6564DC5389F75C6731B8837F1D84AD782E30BBEDA30A8891EB96C505E27
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery xworm rat trojan
- Detect Xworm Payload
- Family: Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- .NET Reactor proctector
  Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Drops startup file
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detect Xworm Payload

Family: Xworm

.NET Reactor proctector

Drops startup file

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2