xworm | a94b43b071a5213c78514215abacbdf17b7067973faf9c1d325482d0e6a25402

General

Target
addwa.exe
Size 32KB
Sample260913-djf1zaec56
SHA256 a94b43b071a5213c78514215abacbdf17b7067973faf9c1d325482d0e6a25402
MD5 086585a865d0ae9633a2362c07e178d8
SHA1 e16954d4700efa35efca668290b6799b7e977ae4
SHA512 26d7c6b4aadbfd6734806b678b189beb7f2f3fa358aeff859c0a24176ee08027387768b27692498375efb99bbd68a3b27fcfd9136e0c244dae910d65e2a425d6
SSDEEP 384:slRmhGD91SluSWhnHHxzLmYL3Tm2eaFO4FzRApkFTBLTsOZwpGd2v99IkuisJVFI:4RPD9OQhx/BL3Tw49FzVFE9jYOjhbbz
TLSH
T169E22B4877E44712DAFEAFB529F262061270D517D823EFAE0CE485E62B67AC047407E6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

xworm

Version

5.0

C2

x0hpgvcqiu.localto.net:2703

Mutex

Aql8j9PIvGGQvYvE

Attributes

install_file
USB.exe

aes.plain

Targets

- Target
  addwa.exe
- Size 32KB
- SHA256 a94b43b071a5213c78514215abacbdf17b7067973faf9c1d325482d0e6a25402
- MD5 086585a865d0ae9633a2362c07e178d8
- SHA1 e16954d4700efa35efca668290b6799b7e977ae4
- SHA512 26d7c6b4aadbfd6734806b678b189beb7f2f3fa358aeff859c0a24176ee08027387768b27692498375efb99bbd68a3b27fcfd9136e0c244dae910d65e2a425d6
- SSDEEP 384:slRmhGD91SluSWhnHHxzLmYL3Tm2eaFO4FzRApkFTBLTsOZwpGd2v99IkuisJVFI:4RPD9OQhx/BL3Tw49FzVFE9jYOjhbbz
- TLSH
  T169E22B4877E44712DAFEAFB529F262061270D517D823EFAE0CE485E62B67AC047407E6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

xworm rat trojan discovery
- Detect Xworm Payload
- Family: Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Executes dropped EXE
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detect Xworm Payload

Family: Xworm

Executes dropped EXE

Drops file in System32 directory

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2