xworm | b49a043c8b0647151180e74c22807ea44a52545b878b21312dacfabedbd73402

General

Target
b49a043c8b0647151180e74c22807ea44a52545b878b21312dacfabedbd73402.exe
Size 691KB
Sample260702-xy2e1ac14v
SHA256 b49a043c8b0647151180e74c22807ea44a52545b878b21312dacfabedbd73402
MD5 31e5990b18f1a6d2aa037fb3a3f40f10
SHA1 dce9d46402c26b8182b163c30bc58d690a4ac8e7
SHA512 660003dc2c535b479fe17918e563fe1270c7929fd0718b98892a00d428687883ab459cc0cfe3ae0c07728a5c92cf401bd1fd54ad8ea5b9d78c3670cb28504e7f
SSDEEP 12288:DVcnxX55Kl85eEKlcVOJJ+x9SJAWP+TfNDUP/HFjtp:DmnNr+OWcsJJ89SJAWP+RD+
TLSH
T1BCE4122A1B19CA0AD4A72FF00D32E1B067B90D8CE511DF07AFDABEDFB1756201545B92
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

xworm

Version

5.0

C2

31.56.209.126:1996

Mutex

uMh4zbD5EZQrHaFJ

Attributes

Install_directory
%AppData%
install_file
bin.exe

aes.plain

Targets

- Target
  b49a043c8b0647151180e74c22807ea44a52545b878b21312dacfabedbd73402.exe
- Size 691KB
- SHA256 b49a043c8b0647151180e74c22807ea44a52545b878b21312dacfabedbd73402
- MD5 31e5990b18f1a6d2aa037fb3a3f40f10
- SHA1 dce9d46402c26b8182b163c30bc58d690a4ac8e7
- SHA512 660003dc2c535b479fe17918e563fe1270c7929fd0718b98892a00d428687883ab459cc0cfe3ae0c07728a5c92cf401bd1fd54ad8ea5b9d78c3670cb28504e7f
- SSDEEP 12288:DVcnxX55Kl85eEKlcVOJJ+x9SJAWP+TfNDUP/HFjtp:DmnNr+OWcsJJ89SJAWP+RD+
- TLSH
  T1BCE4122A1B19CA0AD4A72FF00D32E1B067B90D8CE511DF07AFDABEDFB1756201545B92
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery xworm rat trojan
- Detect Xworm Payload
- Family: Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Drops startup file
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detect Xworm Payload

Family: Xworm

Drops startup file

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2