xworm | c93ab5e9b017961c0f239ef2638f4ab649dd34ca7a9f5ce24dce914a7aec1863

General

Target
c93ab5e9b017961c0f239ef2638f4ab649dd34ca7a9f5ce24dce914a7aec1863.bin
Size 1KB
Sample260813-spbe1asgph
SHA256 c93ab5e9b017961c0f239ef2638f4ab649dd34ca7a9f5ce24dce914a7aec1863
MD5 9eb48f3c7bb6ee5ab9a66b154b17eb89
SHA1 e50e63576251c1d73b2d4ef1a55d8c7d68321bcc
SHA512 6e1a29f6df112f0452f70656a49cad9fdc10593a848fd92efb859a5a04b9f0e84de97d26b0331171933929939ab1f0f6b143e71ed86c202bddc017bea5ae7a1c
TLSH
T1E741E68955ADCAED08CEE047E4523983C3623149451456B2C7CECB7B40EE83E623D647
MD5 SHA1 SHA512 TLSH

Score

10^/10

Malware Config

Extracted

Language

ps1

Source

URLs

exe.dropper
http://193.104.58.65/yurumpmonday.png

Extracted

Family

xworm

Version

5.0

C2

155.103.69.171:1122

Mutex

U3dUcfZQCoVMcpk3

Attributes

install_file
USB.exe

aes.plain

Targets

- Target
  c93ab5e9b017961c0f239ef2638f4ab649dd34ca7a9f5ce24dce914a7aec1863.bin
- Size 1KB
- SHA256 c93ab5e9b017961c0f239ef2638f4ab649dd34ca7a9f5ce24dce914a7aec1863
- MD5 9eb48f3c7bb6ee5ab9a66b154b17eb89
- SHA1 e50e63576251c1d73b2d4ef1a55d8c7d68321bcc
- SHA512 6e1a29f6df112f0452f70656a49cad9fdc10593a848fd92efb859a5a04b9f0e84de97d26b0331171933929939ab1f0f6b143e71ed86c202bddc017bea5ae7a1c
- TLSH
  T1E741E68955ADCAED08CEE047E4523983C3623149451456B2C7CECB7B40EE83E623D647
- MD5 SHA1 SHA512 TLSH
Score

10^/10

discovery execution xworm rat trojan
- Detect Xworm Payload
- Family: Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Detect Xworm Payload

Family: Xworm

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2