Overview

overview

10

Static

static

10

f79a0e092e...ed.exe

windows7-x64

10

f79a0e092e...ed.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f79a0e092e261977846be4ea9871a45b89e5716d38a61c753e68ca2315286bed.exe

  • Size

    58KB

  • Sample

    240701-qphg7stfng

  • MD5

    e7402bd65e8bff7c8776f808f48b4bee

  • SHA1

    c686004ad859893867ada0a212713c699cf16272

  • SHA256

    f79a0e092e261977846be4ea9871a45b89e5716d38a61c753e68ca2315286bed

  • SHA512

    22b6c6e556210104be395eae67407f49046ad85e5601f8f6f85c0b857a45ef2d5a557c884204822ea360dd959e414d2c43312902ebc7c81778c5d37810516b44

  • SSDEEP

    1536:d1b8dHo9Fz9LJOjQF5311095FIA19G7qZb:IHo9Fz9LJOjk0nX19PZb

Score
10/10
xwormrattrojan

Malware Config

Extracted

Family

xworm

C2

week-neck.gl.at.ply.gg:7880

wiz.bounceme.net:6000
Mutex

rQQ4V3IRAciQgn0j

Attributes
  • Install_directory

    %Temp%

  • install_file

    USB.exe

aes.plain
aes.plain

Targets

    • Target

      f79a0e092e261977846be4ea9871a45b89e5716d38a61c753e68ca2315286bed.exe

    • Size

      58KB

    • MD5

      e7402bd65e8bff7c8776f808f48b4bee

    • SHA1

      c686004ad859893867ada0a212713c699cf16272

    • SHA256

      f79a0e092e261977846be4ea9871a45b89e5716d38a61c753e68ca2315286bed

    • SHA512

      22b6c6e556210104be395eae67407f49046ad85e5601f8f6f85c0b857a45ef2d5a557c884204822ea360dd959e414d2c43312902ebc7c81778c5d37810516b44

    • SSDEEP

      1536:d1b8dHo9Fz9LJOjQF5311095FIA19G7qZb:IHo9Fz9LJOjk0nX19PZb

    Score
    10/10
    xwormrattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Drops startup file

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Tasks