xworm | 6ab7771d68ea6d5821fc6db95d36938daeb492d33aa57d0a3122fe04e1e01f63

Sharing

Copy URL Twitter E-mail

General

Target
bldr.rar
Size 6.1MB
Sample260831-vt5kradp31
SHA256 6ab7771d68ea6d5821fc6db95d36938daeb492d33aa57d0a3122fe04e1e01f63
MD5 67db9cd62dcf6cf693026ff14cddb2d4
SHA1 338ed73e7722041956af15ff274abe4e6573c65f
SHA512 7d536391e7f9c0c207ef691626d1cdef3e07c58ad97d2a58ec9b0138a6513542fc929dde4e2f500383e4fd25957d744a06e3242148cce90bc84f750b4bc6626e
SSDEEP 196608:prjWmOtHs4wGBfID3lRUe+914eetlRz3AvsxihxvbB5LcwQeP4eeLk:pvWmOaGtID3HUx9SLHzQ0xihxvbB5LLH
TLSH
T1195633131949F03F9B235C4CABE1A9F83A68A56560F0F665FDA3C270781C84D636F786
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  bldr/bldr/Form1.cs
- Size 14KB
- SHA256 61665acdd901f610c15dab77d9475fb8cf733b58d34a848f25fd2bcdbc26255a
- MD5 fe7dceea18aebb98c1f73a712dac024d
- SHA1 3589e4295980bb9bb2390973182181e2ef8cc83b
- SHA512 d2d18accc87e98e3fa456a84916fa494a7660dd050571a1e0b7e2459af513ff986f1611323704e71df3c11a84bd7c7254628b309dbd50eeb28c8432c9ebee6f7
- SSDEEP 192:SrO0+fbT1hkANaIplniUr21FLVch0sC1MIMLDRuF6WptOyOFCqy7XSIKjHWMMD6T:SrOry6L21FL49/gtdM2M8aZ5
- TLSH
  T1EB62A608499759A04B874C35EFF77D4A1E22501BC3568C227E9E07D08F78878EEB57BA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  bldr/bldr/Properties/Resources.Designer.cs
- Size 2KB
- SHA256 39108c0c680da9eb1707c1e5abb0825ed250b434361eeb256e543a25bfe35053
- MD5 7903efb9e4d8c22010ee840dd558f44e
- SHA1 a7b4bc036b4a172b4e848be28bf14cc0fd465579
- SHA512 a63f81bf807a55925ce63c4ff8eae8a9ec905e018dbb8a4a40da6d53a89578958964f86e104b26693701421f1aeccf3f4c3daba3559e865ad46215cc790b572d
- TLSH
  T1F751B9B71F95C1324C35D88B8B00F841CB662123CA7CD574B8EE02650FB739443AEEAA
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral3 behavioral4
- Target
  bldr/bldr/Properties/Resources.resx
- Size 5KB
- SHA256 66b5ebd1b0fc73f041ba669ce2184f6f471d5e3524efa34ca31233e9f5395262
- MD5 0cd8c971317d19bbed44757809bcb92b
- SHA1 47b15748ecc8e952c5935170090db7c269ce4b4f
- SHA512 883dba84bf7daae3ea49f9d54c13dda4f125da82ba63f90eeba0900602896ad9492a0adf7b69b67d838034090af20926af5c2934797afaadb38aa069786c1fc6
- SSDEEP 96:fijrkiK5k5LPXbac9m5Lv6FzSvd4gIRjETUT200qSdvabvDIwQBugqvA:KjrbLPD9sLvIzSvKgIqUEa2
- TLSH
  T17FC11245B1C09D220BF3482DE6527988F7A8923B0235AC54B4DCA61F5F73C85A7B33B6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral5 behavioral6
- Target
  bldr/bldr/UI_Generator.ps1
- Size 312B
- SHA256 bcdc19221372518c2b8b5554aa0bdd3da42f5867ea79542848b056b3be72de00
- MD5 f178751e1c64a0ab09c5794c0b3f4f41
- SHA1 c1fc891e5a89e16f69971d35f26579de215526a9
- SHA512 ae5d52839a1752626c31efab2505c91a73aa8676fca751711cff5c43a9353efde63363e3230f00129553350ecdb014e8d4921dde8fd4033c770e4a7104e92539
- TLSH
  T116E0EB6C79F0C37008434400A76FB4689B23620AC3308C0038BE071EDFC06A80224E81
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  bldr/bldr/XWorm_Stub.vb
- Size 76KB
- SHA256 b3db439303c5bd36463e372f172fa5b816683d59e8d9e54797414c10dd733c40
- MD5 cf3208d60a8b307890db880f1767c55d
- SHA1 4beed45f2feb3f6bd4ec0c8f8d6ffaed53f8f966
- SHA512 ff1636a7ab4a43cce6a5dee6db0cce072a878d17bab3555301c53149f57fa5140e177e633598dd0030460fe17a7f4c9a202f2ed1fb68ff14a0a9198dec147467
- SSDEEP 768:UxERT8OmsJyDy+/8OUMQTLVjxipYFy9/0R+i+NnP8tOI7NxcBwjtKYlyjZAb7jZp:Uxzvjc9yCbivWs0
- TLSH
  T16073A5277D05267447CF4984A95FF2463DE3162361186860F4CCA2E48FB67ECE3A53EA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral10 behavioral9
- Target
  bldr/bldr/bin/Debug/CryptoJhnam.exe
- Size 198KB
- SHA256 e80640094ce67c2328ea086229936d1b95cba7179a95812e4b7a489f34b362ce
- MD5 a02263526d13b32e1c473ba0477e34c9
- SHA1 6f8dbfdaad179c6892172a1cee5d993195c7e785
- SHA512 fda0da16ecdbb36a7ed4761e2453eb10329b29a8a83d1ea7a35784ec4781778c9ba4a6f30e6a39c0ea0002a8719bc69643204007deb7d46e9ee5e05b0cfcdeed
- SSDEEP 6144:CZcp8wokzEHk3d2EXO6YaOQn9eea4PFTPBBu+LybRev6j:F8wZzEHk3d2EXO6YaOQn9P/9TPDu+ObV
- TLSH
  T130142A55A7F82759F1FBBBB0A97618500E37BE66A831C24D095C248E1B33B448D76B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  bldr/bldr/bin/Debug/Guna.UI2.dll
- Size 2.1MB
- SHA256 6d876b257a97995d21072acd44580633468516121145cc218277edc18f971030
- MD5 58459aefb74d5ff786b9efb982d44eab
- SHA1 584f851c9824a27f4e2e5594ac206f8b165adf72
- SHA512 80e975d2726eb1e4515a79f3ced422e61315f9b2bcb87d054aa654c1885c12c2a16f75da9aba6f8cd2dd652bb85da50579d1e618f10fab1e50c0cd29f37c7b55
- SSDEEP 24576:mecRcAIrcai1e9RcNiCljNAXCITob+HgbY8DkUKAMDitqTwCTxZmxV7FdHQ/jzwQ:3AIKyo+HgbY8DkRmaZ8V7FyH
- TLSH
  T133A50A147ED4EB27D16BCE33D5E24011E3F1E5A32AB1EB0E76D35768184234A788636E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  bldr/bldr/bin/Debug/Microsoft.Bcl.HashCode.dll
- Size 26KB
- SHA256 3a4e851ee5fc0f6182aa5a3d65dc56fcd6979b65334b5c3b92fbdc791457c0ab
- MD5 64f530f8ddbc93262732071b4db864c5
- SHA1 7c2f349da43199522756e3c8a1d9ec94780888ca
- SHA512 f7f3375ed6325bfaad82ff1817ad434c0ffd113b1175fbc4bdb1507e745f3a9fdec12cff9b2100c7ae96350c91e6e0b0ec24a1c569eb9bfc6b6774d7460fa223
- SSDEEP 384:B0/kajL92ajiAOeRqwDpPIwcAakgj22WVr4WNYA6VFHRN7WszxIPaR9zeN:B0792ajnFRqwpPI4DFClWszxOW9zO
- TLSH
  T192C24A1E829886C3EFAB0D7025F5EB5B3D3853B59C1293B612CAE9181C437C5D621F7A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  bldr/bldr/bin/Debug/System.Buffers.dll
- Size 23KB
- SHA256 2d78d770c9cb997199154ae8c018b9f1d1efbc86729f7264dde6dbad2a12cac3
- MD5 902760412abffbd10be14842e83f0c09
- SHA1 d87680e1a96549cf45506d17566ec08c27a770d8
- SHA512 016a283723e32eedaa3b3c6d92bbd0d4c4d2663ab0f0b74bda56d6d2d742632ea0005b3c0c982ca77dd152b839deed0af07228172f059c9e0840e31b530bd0f2
- SSDEEP 384:7RJyzxhqFAB5n55560IZplFuA6ccxReXWd2WkRnfLXmztvGHRN7LgFA9bFs0R9zJ:FJyYkx60InTuP0njQtaUFQZs49zUS
- TLSH
  T187B27C11D79C422ADE7F1A716AF9DA862E3983C16102E66F144CF5040EE37C9DB31BB8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  bldr/bldr/bin/Debug/System.Collections.Immutable.dll
- Size 247KB
- SHA256 3ed2aaec4942b8dae5e1b4c2cf204f3f38033b436d656607ef1571e778453ee0
- MD5 8041546bc673c55560d8e27d5dfe7936
- SHA1 101cdf5b68f5eedbb98c8477fbcaa251d49194ab
- SHA512 f6e55e1a40af6118f24d483e16cd700eee8c185c8ddc424f0e3c29707b781e27d3933990e9257a98e18bc9fea762329e9641eb0464b27d15e34306692e10c21c
- SSDEEP 3072:mqWFCj166bM6aJAw3DtDbmTX+/iFE1DN6n7vEuKy/TAw9HRuaUhR8VE7oBJsqibs:mqqY66/sqVEUEudE6xu2V1sho
- TLSH
  T1C3344B21BB9C9B32EABF4C73B9B094AA4A31C517A19EF39A25DEF7F018E33145C54054
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  bldr/bldr/bin/Debug/System.Formats.Nrbf.dll
- Size 69KB
- SHA256 5b6b1b8d81ce48a37043bc1cdad7f2c227edc8702086a23aa5274cc8132f738e
- MD5 58b7d46468292a4206d3a4ea90018657
- SHA1 2424c1b50ebeeb01852081f8885d846590be9fb4
- SHA512 2d2006d59cb243a175743703f482bede728642b50469a369dca4c2299ce48343f53eaf5064df4bf76dd5acece13a5507eea34f46241393c82d5182550a63f19c
- SSDEEP 1536:efefdoRvZ2oYoKiuQO6a4EPc7ijUUTNgyBdezX:efefiRAQ0QsPcBwJ6j
- TLSH
  T1BE638D5D23EC576BDFBF0E79B4B8E115073AD54A2002E38D1CC0B9DA195BBC85A2077A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  bldr/bldr/bin/Debug/System.Memory.dll
- Size 141KB
- SHA256 d5e8e4866f9cfa66f7765660f84b210198893e55335487afe5ebda342c0e913d
- MD5 bd7f42207f4fdb9c7eafb0013abd7334
- SHA1 96c87b7148805a0adcd4b9e23162deb06d7a4702
- SHA512 a903fda3c5585af8978918c6fa5dd7649e84bee41d0dfa09667e151819d74e16cff626595eb9760588bec12c0b8ec31f527e7dc84800378683156309c3247240
- SSDEEP 3072:IPgSRYPuMbrhcabqwwwUumu36xNOIRJAW:OuPaaWwww4u2HX
- TLSH
  T161E35CBC67C6DD12CB5F8C70A028621A5A31873FAD43F7E615C8E4F425A37A936193D2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  bldr/bldr/bin/Debug/System.Numerics.Vectors.dll
- Size 107KB
- SHA256 20c2fa81b8c70d651099d762954f285fd4f942e63b2d7217c145dab8d4b2f4c9
- MD5 a57f205ce75d4e4a19020e8b627469c4
- SHA1 c5583c3257cf193ff4736671445f8da64366a6a1
- SHA512 6b5985cb7ae4daecd1be3d6dbc709171ec94b89c0671aec1dc7288e08f5fe172900be75da1c43b75fff37504a33e7f8992c66581e562397f47e2ef2cefb46b54
- SSDEEP 1536:2uIaashZlF/cLecJE3+DWG/E2NstmOz+IAKvR7NQcmzF9:2zaashZzWeca3+DWG/E2itDf9NQ7J9
- TLSH
  T147B3DFE22F6C655AD7CF9F7B20E64E120B331963C403D2E160DC67A227A776729421E7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  bldr/bldr/bin/Debug/System.Reflection.Metadata.dll
- Size 503KB
- SHA256 fb977d30746f4cd1f417302324fcbb6174dd24237dda34cade53f35055e74384
- MD5 986669da20c7f91bee712a661baba38f
- SHA1 5f4efc25233c2fb9e4de3d59c94af576841bcaea
- SHA512 082be3767f48de1da02fc35c6a05ac4252618fe1b51b4d06d875a815a9f5ef705ab0e798a08a3207555ffd641110b1c962f88dca257463f44b857ad806b8863d
- SSDEEP 6144:zjyrbeSP7DOQnA4OV6xB/E7nZDctMGEklhOz/C3Ew:zjyWkVJCnJGEkPQC3v
- TLSH
  T19BB45A5433BC673BC6AF4BB4F0B108294771E845BB17F75E9948A26A0C93B59CC10BA7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  bldr/bldr/bin/Debug/System.Resources.Extensions.dll
- Size 113KB
- SHA256 b809ad34d54f52f6ac92f7ff183b39880225a0729aeba91795cf9880e600906a
- MD5 b39412115893f90b50fa2c30d1f6e857
- SHA1 4df4755e724765f8492cc8529f8430e3487aa862
- SHA512 0846577ac54c77507d041091a0c906d713beb43886763e4894549f407cba9ba9d193d9c7589ff3f5471204a525c60cfd1f19d20156bcec49682e9e5ba6de3f4a
- SSDEEP 1536:ilEGrd+4ykkst1GWBtViHRpCSVIO91TbUcg6gNcV2R3Pz:ilNx+dkk0sgtipLI6LcP
- TLSH
  T16DB3070273FC565AF6FB1F75A9B450104F367EA6A936D75E488010EE09F2B808A70B77
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  bldr/bldr/bin/Debug/System.Runtime.CompilerServices.Unsafe.dll
- Size 18KB
- SHA256 08cbd7278b66f1e68425a82d4b97181a4130d93e3dd91831407aba7212ccdacf
- MD5 cb5b861883d2bddd9833c9fe956406f7
- SHA1 43290cd4aaf80df5d1cf9f242486ef8e646fddda
- SHA512 79de2065d8af3713662afb2a10e0a62c0821920608cc63cc2a47a09dc7bb6baf1fa71612da3ebe22d410ddc92fe52c0261faa019839d241fe9252d1663f4f4c1
- SSDEEP 384:RGbUedrbbxT4WT2WCwnHRN7bEpGR9z04yy:RGpd1R3XbEY9z
- TLSH
  T1F0827C24C7E44503FE627F3485ACE543BE3893960902D72B2582F57A0C973D8AE35A2C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32