xworm | 8c8492a4f923e63d050459bd3de9e35524f0d9efe8397ad6ee2fc89bd713f9c6

General

Target
8c8492a4f923e63d050459bd3de9e35524f0d9efe8397ad6ee2fc89bd713f9c6.exe
Size 696KB
Sample260702-m6gqfsey9k
SHA256 8c8492a4f923e63d050459bd3de9e35524f0d9efe8397ad6ee2fc89bd713f9c6
MD5 1b8592d2206d7d2d6449a878329f5133
SHA1 7a5cf0da662195b9f5ae5009e10db6d9bf2bad02
SHA512 ed0a89fa06ee463329e624342263450e090075d27f723b807e99c2cdd69490be175facd98d7f0d6d7c8c44ec635728c504f7ea66dbd80bac63708096f680a2c4
SSDEEP 12288:zDdnxX55xUBf6rXToKRL0qUjmgek2MK4QN1edHPIM89t/Eszomgfrpy8ICc5jIHe:z5nNrxsfU8K9J42MK4Ced5o4tfr6CUI+
TLSH
T1ADE41228262DE61BD4AA17F41DB0D17067B80E88E525E7039FCA3FEFB8797261445383
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

xworm

Version

5.0

C2

172.94.15.100:6070

Mutex

aNbgwhDHUdGil4Mi

Attributes

Install_directory
%AppData%
install_file
XWormClient.exe

aes.plain

Targets

- Target
  8c8492a4f923e63d050459bd3de9e35524f0d9efe8397ad6ee2fc89bd713f9c6.exe
- Size 696KB
- SHA256 8c8492a4f923e63d050459bd3de9e35524f0d9efe8397ad6ee2fc89bd713f9c6
- MD5 1b8592d2206d7d2d6449a878329f5133
- SHA1 7a5cf0da662195b9f5ae5009e10db6d9bf2bad02
- SHA512 ed0a89fa06ee463329e624342263450e090075d27f723b807e99c2cdd69490be175facd98d7f0d6d7c8c44ec635728c504f7ea66dbd80bac63708096f680a2c4
- SSDEEP 12288:zDdnxX55xUBf6rXToKRL0qUjmgek2MK4QN1edHPIM89t/Eszomgfrpy8ICc5jIHe:z5nNrxsfU8K9J42MK4Ced5o4tfr6CUI+
- TLSH
  T1ADE41228262DE61BD4AA17F41DB0D17067B80E88E525E7039FCA3FEFB8797261445383
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery xworm rat trojan
- Detect Xworm Payload
- Family: Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Drops startup file
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detect Xworm Payload

Family: Xworm

Drops startup file

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2