xworm | 4e9a6d2c5130f2149fa5a957a23db083f2e864579f02bbe8a6a8fdee65a60894

General

Target
4e9a6d2c5130f2149fa5a957a23db083f2e864579f02bbe8a6a8fdee65a60894.exe
Size 1.0MB
Sample260707-s9vpdagy51
SHA256 4e9a6d2c5130f2149fa5a957a23db083f2e864579f02bbe8a6a8fdee65a60894
MD5 cbf46d581cd7a86eaeb2b44793f41bff
SHA1 fa2a9945793707ff83adbf2cc3979912f3b2a4a4
SHA512 8940007052ca6b468839325b28b8faa3c6ce6a39a77bea1c11e5dae6fa48acb519d46b6470d9b2a6f7b72cbd3457aff6fc7984914feb6a1f8ad5da84620bd9d1
SSDEEP 24576:xCZGvW0tK4jReYSTQ+zYAGRw5bUkGDjkNrR1:21H4jR2TYrQbDTrR
TLSH
T1F0356B0573A442DDFEABE1768A13C507C7B27C450677861F06A4BA766F33B712A2E321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

xworm

Version

5.0

C2

107.173.143.20:7004

Mutex

SyYYqdoljYBl4one

Attributes

install_file
USB.exe

aes.plain

Targets

- Target
  4e9a6d2c5130f2149fa5a957a23db083f2e864579f02bbe8a6a8fdee65a60894.exe
- Size 1.0MB
- SHA256 4e9a6d2c5130f2149fa5a957a23db083f2e864579f02bbe8a6a8fdee65a60894
- MD5 cbf46d581cd7a86eaeb2b44793f41bff
- SHA1 fa2a9945793707ff83adbf2cc3979912f3b2a4a4
- SHA512 8940007052ca6b468839325b28b8faa3c6ce6a39a77bea1c11e5dae6fa48acb519d46b6470d9b2a6f7b72cbd3457aff6fc7984914feb6a1f8ad5da84620bd9d1
- SSDEEP 24576:xCZGvW0tK4jReYSTQ+zYAGRw5bUkGDjkNrR1:21H4jR2TYrQbDTrR
- TLSH
  T1F0356B0573A442DDFEABE1768A13C507C7B27C450677861F06A4BA766F33B712A2E321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery xworm rat trojan
- Detect Xworm Payload
- Family: Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Downloads MZ/PE file
- Drops startup file
- Executes dropped EXE
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detect Xworm Payload

Family: Xworm

Suspicious use of NtCreateUserProcessOtherParentProcess

Downloads MZ/PE file

Drops startup file

Executes dropped EXE

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2