Overview

overview

10

Static

static

1

Request Fo...lsx.js

windows10-2004-x64

10

Request Fo...lsx.js

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    07072026_1320_06072026_RFQ - THEO-MAN .rar
  • Size 982KB
  • Sample260707-qljwvsax7w
  • SHA256 e8772c4730080cbd3c2237beaff88eb8c30079c5705916efcbef2a425bde9584
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
xwormdiscoveryexecutionpersistencerattrojan

Malware Config

Extracted

Family

  • xworm

Version

  • 5.0

C2

  • dontfail.ydns.eu:80

  • winnermood.ydns.eu:80

Mutex

  • e0fDvwUtXlxGEMAM

Attributes
  • install_file

    USB.exe

aes.plain

Targets

    • Target
      Request For Quotation INQUIRY 2607.3539,Xlsx.JS
    • Size 2.5MB
    • SHA256 1dbc9387179c076e47b379e7a797d41f665dc1aab56b16404bc5c31b7271a75d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    discoveryexecutionxwormpersistencerattrojan

    • Detect Xworm Payload

    • Family: Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks