xworm | 187aa13d50ceea33ab4aac1a72c02bcd248ca065901e71bf5ae2941ffaa0a046

General

Target
187aa13d50ceea33ab4aac1a72c02bcd248ca065901e71bf5ae2941ffaa0a046.exe
Size 839KB
Sample260910-mwvvbsvxgw
SHA256 187aa13d50ceea33ab4aac1a72c02bcd248ca065901e71bf5ae2941ffaa0a046
MD5 edaedafabfa469ed79b73b350315d1b2
SHA1 6a6ad0a1f4daa1a437e2269a44122fb979cc535b
SHA512 7bc5dc25b9555f82b3ac84c7f55ffb2ddd9e38253f55caf690ac0b66a56c45a880d82f9b05217416c54b9ccfb97df83e93958b77c2c8f2ca97f09cd97a54487a
SSDEEP 24576:sQR+io0hWFHeTESrjSnVma5QBE0xF5coY/1:sQRa0SH3uA/5Lqy/1
TLSH
T17B05F11833A6D906D5655FB80C71E3B54FB52E89E460D3139EFABEEFB936B045804283
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

xworm

Version

5.0

C2

31.56.209.234:443

Mutex

6LTYhMtYJSwSKkQV

Attributes

install_file
USB.exe

aes.plain

Targets

- Target
  187aa13d50ceea33ab4aac1a72c02bcd248ca065901e71bf5ae2941ffaa0a046.exe
- Size 839KB
- SHA256 187aa13d50ceea33ab4aac1a72c02bcd248ca065901e71bf5ae2941ffaa0a046
- MD5 edaedafabfa469ed79b73b350315d1b2
- SHA1 6a6ad0a1f4daa1a437e2269a44122fb979cc535b
- SHA512 7bc5dc25b9555f82b3ac84c7f55ffb2ddd9e38253f55caf690ac0b66a56c45a880d82f9b05217416c54b9ccfb97df83e93958b77c2c8f2ca97f09cd97a54487a
- SSDEEP 24576:sQR+io0hWFHeTESrjSnVma5QBE0xF5coY/1:sQRa0SH3uA/5Lqy/1
- TLSH
  T17B05F11833A6D906D5655FB80C71E3B54FB52E89E460D3139EFABEEFB936B045804283
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery xworm rat trojan
- Detect Xworm Payload
- Family: Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Uses the VBS compiler for execution
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detect Xworm Payload

Family: Xworm

Uses the VBS compiler for execution

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2