xworm | e9033fe0ddd54edbf0ed4a6f448790339acf2e08fe8c0b58f1931fc9fd718678

General

Target
e9033fe0ddd54edbf0ed4a6f448790339acf2e08fe8c0b58f1931fc9fd718678.bin
Size 32KB
Sample260814-vtxj5sah84
SHA256 e9033fe0ddd54edbf0ed4a6f448790339acf2e08fe8c0b58f1931fc9fd718678
MD5 8e192fc7f84975f4cbf34f15f778e97b
SHA1 cc5420493bbfa109d62979c3450e46a6ba0174b5
SHA512 a88b7ff4e313035296529a694e2256f5787d8499786492993b9f92007c14ca4fadafede747ee29b44e043c16a50390b4d15f157a03bce692a41b69262f513f98
SSDEEP 384:4YaJWq4Ava7Rm32oDuuw3+q5XwYeLBEwvh0FbOKTCOQS+RApkFTBLTAOZwpGd2vF:QxC3fOJ5ywvGFbO75S+VFo9jCOjhNbt
TLSH
T1C2E23B4877E44312C5FEAFF02DF2710A1675E11B9823EB5E0CD4C99A2B63AC146507EB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

xworm

Version

5.0

C2

51.79.134.41:7004

Mutex

bHHHSYqO0sJoFhba

Attributes

install_file
USB.exe

aes.plain

Targets

- Target
  e9033fe0ddd54edbf0ed4a6f448790339acf2e08fe8c0b58f1931fc9fd718678.bin
- Size 32KB
- SHA256 e9033fe0ddd54edbf0ed4a6f448790339acf2e08fe8c0b58f1931fc9fd718678
- MD5 8e192fc7f84975f4cbf34f15f778e97b
- SHA1 cc5420493bbfa109d62979c3450e46a6ba0174b5
- SHA512 a88b7ff4e313035296529a694e2256f5787d8499786492993b9f92007c14ca4fadafede747ee29b44e043c16a50390b4d15f157a03bce692a41b69262f513f98
- SSDEEP 384:4YaJWq4Ava7Rm32oDuuw3+q5XwYeLBEwvh0FbOKTCOQS+RApkFTBLTAOZwpGd2vF:QxC3fOJ5ywvGFbO75S+VFo9jCOjhNbt
- TLSH
  T1C2E23B4877E44312C5FEAFF02DF2710A1675E11B9823EB5E0CD4C99A2B63AC146507EB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

xworm rat trojan adware discovery spyware
- Detect Xworm Payload
- Family: Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Drops desktop.ini file(s)
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detect Xworm Payload

Family: Xworm

Drops desktop.ini file(s)

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2