General
- Target 0543862271.rar
- Size 848KB
- Sample261102-m2pkhag13x
- SHA256 d45ccb091b58fb91089dde84995180436fdff6ff50e77afa1705342fffaf2ebf
Score
10/10
Malware Config
Targets
-
- Target 0543862271.rar
- Size 848KB
- SHA256 d45ccb091b58fb91089dde84995180436fdff6ff50e77afa1705342fffaf2ebf
Score10/10-
Detect Xworm Payload
-
Family: Xworm
Xworm is a remote access trojan written in C#.
-
Executes dropped EXE
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
- Target 0543862271.JS
- Size 2.3MB
- SHA256 bf01e1afb1c74fa05ad9f0d62b5f331a6e82e344b2b7bbc1a6db1aaece7de7f0
Score10/10-
Detect Xworm Payload
-
Family: Xworm
Xworm is a remote access trojan written in C#.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2JavaScript
1Windows Command Shell
1