Overview

overview

10

Static

static

3

XwormBuild...st.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    XwormBuilder_vmtest.exe
  • Size 3.1MB
  • Sample260730-wlc17sdc72
  • SHA256 cfd49c437014ec5b712e003b6e56328fdba7793fce0fa13899a16ec96888f315
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryransomware

Malware Config

Extracted

Path

  • C:\Users\Admin\Videos\README_RANSOM.txt

Ransom Note
  • YOUR FILES ARE ENCRYPTED All your documents, photos, videos, and databases have been encrypted with military-grade AES-256. To recover your files, you must DM "kovakb" on Discord. Your PC ID: 6164306462303936 Do NOT: - Rename encrypted files - Use third-party decryption tools - Reinstall Windows These actions will result in PERMANENT data loss. You have 72 hours.

Targets

    • Target
      XwormBuilder_vmtest.exe
    • Size 3.1MB
    • SHA256 cfd49c437014ec5b712e003b6e56328fdba7793fce0fa13899a16ec96888f315
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    defense_evasiondiscoveryransomware

    • Clears Windows event logs

      defense_evasionransomware

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

      discovery
    behavioral1

MITRE ATT&CK Enterprise v16

Tasks