xworm | 73cbf3bb6a9c46790011fefb814b16230dc2f0a5b3cd1da97c1e5b8e0562c9db

Sharing

Copy URL Twitter E-mail

General

Target
blue driver.rar
Size 3.3MB
Sample260905-2cd5sstema
SHA256 73cbf3bb6a9c46790011fefb814b16230dc2f0a5b3cd1da97c1e5b8e0562c9db
MD5 76b5d5b89702727283641d45beb60351
SHA1 b8b217e892f415c3580bcceef26ac46ecafa5e6e
SHA512 63a89d813ac844c4e17f721270d9ed49a80386167f5a1aeb884e28c70f551fc302a1046b58b3abadaf0705cc2645f7290c0d71911c541b77e33d9eed0bd8d75b
SSDEEP 49152:nD6vaFhBMoztg1HPt0nOcW2YTcW2Y5cW2YaKSJJUzOFhkszAPFh7rOF6w0zmOqi:nD6NrHPVlTTlT5lToJUeeZsFTGqi
TLSH
T197F5332D2D90840BDFD65B39828EEA943373D295438D82A75241A361F46C737AE3DA1F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

xworm

Version

NaZf-36133.portmap.host:36133

Mutex

HP4eZQyRSJEVK552

Attributes

Install_directory
%AppData%
install_file
XClient.exe

aes.plain

Targets

- Target
  blue driver.rar
- Size 3.3MB
- SHA256 73cbf3bb6a9c46790011fefb814b16230dc2f0a5b3cd1da97c1e5b8e0562c9db
- MD5 76b5d5b89702727283641d45beb60351
- SHA1 b8b217e892f415c3580bcceef26ac46ecafa5e6e
- SHA512 63a89d813ac844c4e17f721270d9ed49a80386167f5a1aeb884e28c70f551fc302a1046b58b3abadaf0705cc2645f7290c0d71911c541b77e33d9eed0bd8d75b
- SSDEEP 49152:nD6vaFhBMoztg1HPt0nOcW2YTcW2Y5cW2YaKSJJUzOFhkszAPFh7rOF6w0zmOqi:nD6NrHPVlTTlT5lToJUeeZsFTGqi
- TLSH
  T197F5332D2D90840BDFD65B39828EEA943373D295438D82A75241A361F46C737AE3DA1F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  blue driver/Brz.cab
- Size 143KB
- SHA256 9ab27dc10598e108fefcfdbe111507e0a1da8397599ba86f86716692e51bf790
- MD5 72c491cda9fc941d898a75074306912d
- SHA1 9c2d945ce037bfcb04ad9cfca8bc2e598944aaff
- SHA512 2c86317e251e4736058bd2e41c45a220484079b8022c73e8a95e632b3ad5c8911146fe1ef5436cd9ef6515d7c6974ab0342d3d00ea8de33af81265844e881bb1
- SSDEEP 3072:+hFqqbH2qY1sI/JQfcaqvgCg5YrDXlQvdQqm2jfz/CItmKGtLle3YO:+hFqkH23qI/GfsIwlShvfL9tXGRl2YO
- TLSH
  T1CAE31247A6D201939D82775D45E4B701011BE3BBB7DBA0E366C013B216FE3CA066AD6F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  TargetDir/Theme/Default/EAX_Spr_AppTitle_EAX.bmp
- Size 16KB
- SHA256 82a7100bc4afef8fb80b0f17770d324b7d264738dd92e644f401e3e4f7cc8a33
- MD5 7469ba5cd56d99eda9116b2c7957233a
- SHA1 9893227c9738ef6d1745f54ee0041a1da4f46276
- SHA512 2b5f57caac159e0091c98417c86671b4f788c17a73657f53b7e1b21960c518a46ccc39d43fe45dfeba2e484f3ed0e70a9c9110df8c03799daa4de68b58d21c74
- SSDEEP 96:OQRd1dyZTxXqrDGKjiqgZKcJ0O8HgO4BPGwiabLNTV4N43:OQ31dyZTxX2DbHgZKcJ0O8FnabLENQ
- TLSH
  T161726BE1B976A990C5D143B07BA38144601B0ED1C2CE8BAD794B7F9A73BB311791CB83
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  TargetDir/Theme/Default/EAX_Spr_AppTitle_EAXHD.bmp
- Size 16KB
- SHA256 812c6d1b58bc23ca8f327f35ba2cb0f695d232a2a7d65034a91cec1db769b74e
- MD5 b739cc9b65955a64be3c3148c0423d8e
- SHA1 6b110088822b366fecf3cab85103eccc3620f090
- SHA512 2c1cc1553da9de547dc90cd864f1191fc4adb277dc771216c3a5e31c5591e393a2501245f3d78d764b339e14f63368035948166a1af0d8020373d24c5f45b773
- SSDEEP 192:O4U7rjHlRHkHYs6UWmJRDp2P37CqryjtN:OL7flRHUYs6GDp2P37CqryxN
- TLSH
  T10F72C0E2A135A954C1D803F17BA78409A14B9ED6C6EC979C784B3E4A33BB351760CBD3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  TargetDir/help/EAX.ini
- Size 757B
- SHA256 27a3df241c6c0e25143dc4c24b732c74412fc2ca29cf6307f175106eca755cea
- MD5 d6e4a54e19d02e4a26103980ae3fb0a9
- SHA1 68a2a74cd24a3f8feecab455c26077c07d1ce110
- SHA512 717b746e96296f31df2fcd904e1b87b6035359fdd1d09f02a736307cdbdabe125f0826d219ef99d10eebf0cc7f02a17c2ab08c0f4be73d4a4c13517dfdd96b49
- TLSH
  T15F012876835AEA48714E84FD378696C765F452A444C38A40C329A83D33C7B6DCA22705
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral10 behavioral9
- Target
  blue driver/CTEngine.ini
- Size 115B
- SHA256 a15099971534cae66ef934ad8cd56ac12ae761b5dfeda294adc57cfd7f180527
- MD5 b89cf6ef1acf67dd0c45a1757486fcfe
- SHA1 94f637b5ac4c188ac0703f08fe3573ad162ac5aa
- SHA512 8d3250f00971c5fd6fc3ee47b014789904a6b5f9ff23c9b9eb895a6d30259fa6928996762c2e9ec441ad30827c597d3409603b5e166abee56782d203fafed754
- TLSH
  T1CEB092FA369282A1619861A6E13852CF9181185B25AAF29A8991B1623E714422278086
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  blue driver/CTShared.ini
- Size 156B
- SHA256 1f3387d25e18af590f0ab8c5738ecbe1b11501fa64047b30c573747cf8b0aca0
- MD5 f31e85f26fd1bafa29408ec83562749f
- SHA1 288c3818ef78cad91968b4e050eb5a3759844efd
- SHA512 4c2da34a49c4bf4d9363eea63f7b56b5dfbd9d65a7fdbc00981b29cd948fc89d08bda07b5c04c50cefec498a1d568132bcfd5952123e86d616b5679f0698de1c
- TLSH
  T170C09B25FD27A5F4A341D0DC3640C5BDD50711C34F71645915D490C67D55DE1171D5E4
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  blue driver/Chs.cab
- Size 145KB
- SHA256 8e0c6a73198bbb20bb8888003286aab8a790c55376fd5790db6277e0c610a6da
- MD5 a75675fbc75c8fe708b8ef9e874fd59c
- SHA1 fa52f1fcecfd20043332727af0e8a6123d900bc0
- SHA512 b08190a27422a01569fa6216ad8f9b7dd2ea610a972dcea256d57317893dcbb1670b31e17c4253d275d279cc433617ac7d291d2fcb26c35f561afc865f365c9b
- SSDEEP 3072:FXd3GkeSelGDSg9LyBlAFFsbaWaXviUBqivnPgJfuf:F3evoeQyUjsWt7vn45uf
- TLSH
  T12CE3122809CC9123FCF2D5FDC01AB7D45CA9D9AE5EEA3035C8890655C4E4FEA9A1F163
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  TargetDir/Help/EAX.ini
- Size 621B
- SHA256 741436c515d3355ef66e174a231860e272778165050e408e22668b99d8a2e2b0
- MD5 6df91f4329e8f5fa9b3e29e4ad6504bc
- SHA1 d52977a5f8e8a8a72055af13e2eac356822355b1
- SHA512 8415ae648d6f77410c2406bee98286ad51bafdeeae2bfbd2a04e023e192279b68d5a226a919a020ca088598473ce629d62f676daad2931be856402d54f2b5523
- TLSH
  T145F078128313EC0830AF88E5778953E3543452450E934A0D933DBDAC2322A7CD522590
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral17 behavioral18
- Target
  TargetDir/Theme/Default/EAX_Spr_AppTitle_EAX.bmp
- Size 16KB
- SHA256 31d9a092dd17fdbeb8f075c1d0927adf83a1ac37b8057a68866efa62aa4794c9
- MD5 f7c31f06624337bd4571a63a50ee58da
- SHA1 76141a033aba7407a42b6e8e779bf1651de02b69
- SHA512 6776c3d43ad7d008200d3e013601957b4a371a98286bae47ce147daddcd130b3f293b19a067d584b62f2c4b770a08743c20266db44461db2ec6b392fcdc09b8a
- SSDEEP 96:OQRd1G4pZDkDGgqk3ccr7ilYeO8ERgAU9AzwLNBg4NM13:OQ31GWZDkDGk3ccvilYeO839AzwLhNMV
- TLSH
  T15E72B1F1B432A850D5E543B8BBA38194A61F0FD0D6CE87AD784B3E4A73B2711740DA97
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  TargetDir/Theme/Default/EAX_Spr_AppTitle_EAXHD.bmp
- Size 16KB
- SHA256 e3ebd86410437c7903ad1b8708ff25d19d54233a51f0cf85f0b9b62466155ea0
- MD5 9d9bb2d89febd10c8a51df79c3d7a4e0
- SHA1 6fce28e8ee95ca14933c4c823c78390275ea2fbf
- SHA512 65bf9264b11a48425eb7163526d849275ccd80e7bab085e966c3a93eab105263e76aeed84948af47630fc559479907d6249132d22e551ecf444df136e8693ee3
- SSDEEP 192:O4U7rjHlRHIAHUOtQ8ImEmr3p2QSbCTu5CPVsB:OL7flRHI4UcEQ3p2RbCTu5CPSB
- TLSH
  T1F172F4F2B431A944C6D843B07BA39008946B4ED0DAEDA39C785BBE1A73B7350711DE97
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  blue driver/Cht.cab
- Size 141KB
- SHA256 86557cdda5eb27c3c76ad60a421d31758803f5cc450fec2807e85bd7286c4189
- MD5 aa06590595b2fac6cf94cb12ab733710
- SHA1 2bf5b0850239188c5b0539c7d1c174cd34ac1292
- SHA512 9ced5deefad70a565c86cc7b48f94ab1780bd6aab8389f78ceccd0ceb13fe3f1c903c9aa4f0bcb4f941f5aff91cb3c162f37b9987527f8e93173448bf9a6048a
- SSDEEP 3072:IRfJohfWs9GDS/ALyBlpqJWUjpGXDvBOvwh+9LXUb4yU:YfYOsAe8yVWVcDvBQwskb4yU
- TLSH
  T195E3122E5591B896F6D781BB1CBBF7640CA2C14B8DEB50808C66CE1AD4BCBD0465FE80
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  TargetDir/Help/EAX.ini
- Size 617B
- SHA256 31be723fa07198d020307b6e64ea0eed6d10d5811edde7b9a4ecebaacebbce26
- MD5 1ca701fa1a58058bc9171e58af749b90
- SHA1 df693b9ac374167fcc038fc1739cbfff0d6eded3
- SHA512 f435af454e9a3d2fa5de3f02f6c7f4866a3038768b7711e75972f115c4f539c7824ac46d297b3ec7e21439b7462b2270457bd79c6e8779994c7ccad79e20f04d
- TLSH
  T10FF022928317EC58F24E84EA7689A3EB6438A38908D34A51D33CBD3C23126ADC522944
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral25 behavioral26
- Target
  TargetDir/Theme/Default/EAX_Spr_AppTitle_EAX.bmp
- Size 16KB
- SHA256 b197f3616d41e25e1526d9ab3cd4cdaee975e21a9744a676c0ebbbe103424238
- MD5 7fee1fede9d7095a4c6c52024d142ff9
- SHA1 a6ae5089a157cc9b2ff06cee1b7c7e1315d8a0e8
- SHA512 960468362f5117a8cb74a2c71a647ce6c7c6ae8819ea316b501eb2b5a4d8ece8736248420f933305a01ddc4b7b91cd3fafe0ca26c548a2937c39564c5c514e49
- SSDEEP 96:OuRd19ihZDoDGzqRcJyzf7bO88g9/wLN7dOj4NLM3:Ou319ihZDoDXcJy77bO83/wLrOMNLE
- TLSH
  T161727CE0B836A985E1DA87B07BE38140155B0FD0D6CE87AD785F3E5A37B6711750CA83
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  TargetDir/Theme/Default/EAX_Spr_AppTitle_EAXHD.bmp
- Size 16KB
- SHA256 26dc9e72cec1effd444d3ccef7d2328c758139a8718870ff72593518b3a24d52
- MD5 01986cf0297815b1e7fceb9b78529fb9
- SHA1 bbe2e9e20d8197164a6135d393ceced22468b0a3
- SHA512 ccf9d303ac42845e112b7a3ab70fe6c8aee25bc58543079251a58bcaade956fea671b4ea5422dbcbff7464a65069b81c8f2220e00b9d72fa8e06299cb4e33d09
- SSDEEP 96:O4UfBlrjHlRHPE1FsAlE757Kp2Z128CXuavX0SDKuwN3:O4U7rjHlRHPEHsA6757Kp2S8Ce80eCN
- TLSH
  T17972C2F2B535A994C4D803B17BA78408A55F4ED5CAEC939C788B7E5A33B7310310CA9B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  blue driver/Dut.cab
- Size 135KB
- SHA256 26de7b4554d6316366169c0607d75eb308adda810218aeb6c192cbe582da139d
- MD5 277f497514caab2ea0466c37c196739a
- SHA1 15a800e13fac93c139352b5cc32d7630676b4c0c
- SHA512 3af389542b2da7b62912ae8ba884ee739fc82c83c645ef13c60f087e1f292aef8948df8307aa347d0915953bb154803e0dad9d4ec4956b0867f9f71d451c78b6
- SSDEEP 3072:ImvyVrF51sbJQfcaqvgCgASzDTAkbVlgyPlByll1SojU0ZCqJ6d2GJ:I4OR5qbGfsIeSs/ll4QU8oNJ
- TLSH
  T1B2D312D6F8910AD77E0BC509051068A5EAB3F35126BF513B3080A8A5F9BED6F770B81D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32