xworm | 8ffa48ec6cd0d223ab64b6b685942afd22af6d7039580a3452b01248fd7e62e4

General

Target
8ffa48ec6cd0d223ab64b6b685942afd22af6d7039580a3452b01248fd7e62e4.bin
Size 23.1MB
Sample260816-sp5zls1ckb
SHA256 8ffa48ec6cd0d223ab64b6b685942afd22af6d7039580a3452b01248fd7e62e4
MD5 3b971bfd067ca2b53f5a0386b9672c3f
SHA1 31d7d9c9375a1c73284d10ee3e044bba828f68af
SHA512 aa086816eca7c90882e9e579233f18d62a7af3bd5d11768a05346be43d4a80d3289d51721d25f383322a1839f6a7a3ef9aff889f64a550d9d515644325ab585c
SSDEEP 393216:mtmkiEj7wlqrrEBXEAphVta510MjnKafH/vUr3S:eQEj7wlqrYBRphc10M2affvUr3S
TLSH
T10237D03B765F271FB47212E5BA1CF88620D1932377FE495BC29B2BC95119EB9AE0C110
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

xworm

Version

3.0

C2

jacobs-webcasts.tun.ply.gg:2858
abu3ofhack-64862.portmap.host:64862

Mutex

dS2KWfaa4eSiTeCU

Attributes

install_file
USB.exe

aes.plain

Targets

- Target
  8ffa48ec6cd0d223ab64b6b685942afd22af6d7039580a3452b01248fd7e62e4.bin
- Size 23.1MB
- SHA256 8ffa48ec6cd0d223ab64b6b685942afd22af6d7039580a3452b01248fd7e62e4
- MD5 3b971bfd067ca2b53f5a0386b9672c3f
- SHA1 31d7d9c9375a1c73284d10ee3e044bba828f68af
- SHA512 aa086816eca7c90882e9e579233f18d62a7af3bd5d11768a05346be43d4a80d3289d51721d25f383322a1839f6a7a3ef9aff889f64a550d9d515644325ab585c
- SSDEEP 393216:mtmkiEj7wlqrrEBXEAphVta510MjnKafH/vUr3S:eQEj7wlqrYBRphc10M2affvUr3S
- TLSH
  T10237D03B765F271FB47212E5BA1CF88620D1932377FE495BC29B2BC95119EB9AE0C110
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery xworm rat trojan
- Detect Xworm Payload
- Family: Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

3

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detect Xworm Payload

Family: Xworm

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2