xworm | 168e24a7d9498172a32b51885248f7e51adf1cd11d4126662d2e4ffe575a5bbf

Sharing

Copy URL Twitter E-mail

General

Target
168e24a7d9498172a32b51885248f7e51adf1cd11d4126662d2e4ffe575a5bbf.bin
Size 10.0MB
Sample260925-3agctayfrb
SHA256 168e24a7d9498172a32b51885248f7e51adf1cd11d4126662d2e4ffe575a5bbf
MD5 3f733ae276ac32c75d03d63b5220ae13
SHA1 dbe877031e934d53110f5cb5d366822a2a387496
SHA512 eb77a68e03fa53aca69ffa15308eee1b8e2f8041ed8e1075c08a389f84dd1ac911fe0688b94fa357baa5fbb83d2e86755a689bc9d9dfac1a27ff64581b25a102
SSDEEP 196608:/Vx/8r7G6Tw/OVCdADccTd7i94M43R9KC1x5lMrgziFc6PJy1p8mxe:N58rdTYwCdAQE24M43RAC1PlM7c6Rxm0
TLSH
T137B63395EDA7A92E1F00B8071F801E44BFDC1CFABDBD2C2653BE66A4A0954FD049D81D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

xworm

Version

XWorm V6.5 by c3lestial.fun

pakazadi1145-52069.portmap.host:52069

Mutex

4m3uHdKp7RlanClr

Attributes

Install_directory
%ProgramData%
install_file
Services.exe

aes.plain

Targets

- Target
  bp/AdbWinApi.dll
- Size 104KB
- SHA256 8dd478b2c2cbfc07b15b5effe428c0a156a5636643f35afcb0256110dc316a5f
- MD5 612837236ca2cbd1bd81ba0000e90422
- SHA1 38897f445db0e65b2cd8b36ba7a5af631c793afe
- SHA512 d9d93ebc5b737bf0b38f4efe3c00fb4a82821fc8e918865a8fb47ee76cdb4455a836c41dd816b07701f7561a55848098f9418c18ab02ada73e733131d6d9b73d
- SSDEEP 1536:EpCxybY0FS6MqS6WvgD9xj03TabrFvY5J6sCGt77q:Epo0k6ZWVTaif6sCGtG
- TLSH
  T194A36B313891C472D8D372B955ECF675A27EE0A00B6589C3379803DEDE643C26E7929B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  bp/Hacks/hack.exe
- Size 41KB
- SHA256 fc09681147371570bc8949806316d25c1b08be701437b151da72a0c1ddac6e0e
- MD5 7cfe1c7c32f92c4a6afa088985fb095a
- SHA1 22ec12ce63932906604b408fb63044ac6a9af108
- SHA512 f2abc087ae2ff7698492f2248ac831776756bf53adb0c70591f21636c60c95ff4346b92ad9d1ae5948481a7d09fdcc3978d6365fce06d3523b404995e7f2819f
- SSDEEP 768:mbsRtmbHIZRqFZk8womL1dlrF5Pr9p5O6iOwhg3/OO:mbsQIZMnvBQpFp9TO6iOwOJ
- TLSH
  T1C3133A057B918625E5FDABB519B266030731E6038D23D79E0CE897DB2B67AC0CE807D7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery xworm rat trojan
- Detect Xworm Payload
- Family: Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral3 behavioral4
- Target
  bp/NanoBypass.exe
- Size 9.9MB
- SHA256 943e9cd98425574324495951d988f135eb75ac739d69af24dbfe6441398bb33b
- MD5 6ff8b61f5b517ae181d0b69388914aa3
- SHA1 2b4ddbf9e58e428b6d3cc2800f7078dd4beeb198
- SHA512 40b4753eb14074f61edfe60b7d7028d4e812f730e39681f55d4ea5d922390758704e842702b8e87dbfe8da04a3bdcf651229a92749acdf38903b0a1553cb2b31
- SSDEEP 196608:JWGVTwO8B4vcZaHDgrJ1cZrogTnb9uhZth+XojmRO7Mk1fKgZ:sGVfy8cZajyyrogTnJuhDh+XOovgZ
- TLSH
  T12CA6335CAE1EE05BC7015C396E982A04AFD82CD9ADF61C1F37BB15C4E0215FE05A963E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery execution xworm pyinstaller rat trojan
- Detect Xworm Payload
- Family: Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral5 behavioral6
- Target
  bp/adb.exe
- Size 41KB
- SHA256 fc09681147371570bc8949806316d25c1b08be701437b151da72a0c1ddac6e0e
- MD5 7cfe1c7c32f92c4a6afa088985fb095a
- SHA1 22ec12ce63932906604b408fb63044ac6a9af108
- SHA512 f2abc087ae2ff7698492f2248ac831776756bf53adb0c70591f21636c60c95ff4346b92ad9d1ae5948481a7d09fdcc3978d6365fce06d3523b404995e7f2819f
- SSDEEP 768:mbsRtmbHIZRqFZk8womL1dlrF5Pr9p5O6iOwhg3/OO:mbsQIZMnvBQpFp9TO6iOwOJ
- TLSH
  T1C3133A057B918625E5FDABB519B266030731E6038D23D79E0CE897DB2B67AC0CE807D7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery xworm rat trojan
- Detect Xworm Payload
- Family: Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral7 behavioral8
- Target
  bp/injecter.dll
- Size 139KB
- SHA256 f78fc41103dfcc40af8a6341e9e2a13b45c505f479f1f1878571cbde98de27b1
- MD5 630bd0372bc3351aef97954476c76ecb
- SHA1 d9dddfeb1f3e437f49d71aaf9ec438776efac5ee
- SHA512 71a2405b0cb1052d7da8269ac300eb3f01b08fc9a2efdf3921e06c701c65c6b410162528c4699f099680c01868e678e14c3e827dbac34d00ae1a8d6fcdefaedc
- SSDEEP 3072:s01caxUO/gTA/MsPaHWRNbr8WKn9wzRkif+dAxQujXkm:rCaxUO/gTAUsiHWRN8gxQubkm
- TLSH
  T1BCD351FBB01293A9EFED6BF86C005C3257195C997478804EBCDCB614A742D8592FE2C5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detect Xworm Payload

Family: Xworm

Looks up external IP address via web service

Detect Xworm Payload

Family: Xworm

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Looks up external IP address via web service

Discovers running processes

Detect Xworm Payload

Family: Xworm

Looks up external IP address via web service

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10