Overview

overview

10

Static

static

10

fczchecker...er.bat

windows10-2004-x64

3

fczchecker...er.bat

windows11-ltsc_2024-x64

3

fczchecker...er.exe

windows10-2004-x64

10

fczchecker...er.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    9f3fbb6dae7038f703e81a1098859e91a1176c2045a50b1253924402b14f121d.bin
  • Size 20KB
  • Sample260826-sn5bpaea29
  • SHA256 9f3fbb6dae7038f703e81a1098859e91a1176c2045a50b1253924402b14f121d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
xwormdiscoveryexecutionrattrojan

Malware Config

Extracted

Family

  • xworm

Version

  • XWorm V6.5

C2

  • 185.246.113.191:1482:1482

Mutex

  • jLCUUxeSmcf7kAfI

Attributes
  • install_file

    USB.exe

  • localhost

    127.0.0.1

  • telegram

    https://api.telegram.org/bot8700023070:AAFfeAlH9yYrdz7pSM3N6evR74doFksWZQ4/sendMessage?chat_id=7459218766

aes.plain

Targets

    • Target
      fczchecker/checker.bat
    • Size 3KB
    • SHA256 407e6b1791fbac2f3607c8c5c4e19943db735f185d2d40933ff92cf63cec518c
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral1behavioral2
    • Target
      fczchecker/checker.exe
    • Size 40KB
    • SHA256 af0159a8db29269653ee174d642560ab959580b3ddafc98dc31a692a0599bcd8
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    discoveryxwormrattrojan

    • Detect Xworm Payload

    • Family: Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

      discovery
    behavioral3behavioral4

MITRE ATT&CK Enterprise v16

Tasks