XWorm — e6214ec3dc86e8aa709720e5fedaee79fd70b8dc0e25fcadd80ecdde63b50451.exe [e6214ec3]

Statik Analiz — XWorm | ÉLEVÉ | CVSS: 7.5

Fichier

SHA256	`e6214ec3dc86e8aa709720e5fedaee79fd70b8dc0e25fcadd80ecdde63b50451`
MD5	`a1ea911e1a52877455cd62ba133a675b`
Fichier	e6214ec3dc86e8aa709720e5fedaee79fd70b8dc0e25fcadd80ecdde63b50451.exe
Taille	4,166,656 byte
Type	PE32+ executable for MS Windows 6.01 (GUI), x86-64, 8 sections
Stringler	5,643

Bölümler

Ad	Entropi
`.text`	6.23
`.rdata`	6.42
`.data`	3.96
`.pdata`	4.96
`.xdata`	1.78
`.idata`	4.0
`.reloc`	5.4
`.symtab`	0.02

Import Tablosu

kernel32.dll

IOC

SHA256	`e6214ec3dc86e8aa709720e5fedaee79fd70b8dc0e25fcadd80ecdde63b50451`
MD5	`a1ea911e1a52877455cd62ba133a675b`
Domain	`gintmapnetfilereadopensyncpipestat.com`, `exec.in`
BTC	`3ZbgzNTCgCow6uoRELrkntijTnGjw`, `3zqwnz3AwEVPhPH1YxVvD5SpyJR3zT6PFY`, `32H83gVkH7QwjfbWM8mAjJ7BFoRxjc`, `3AJgwjRhQEQwhsG8RnWeFHpZCR5xDU`, `35JwwvShAE7LWS5AnqXeFc55GRZ5nY`
Mutex	`eq.sync.RWMutex`, `eq.sync.Mutex`, `sync.runtime_SemacquireMutex`, `runtime.mutex`, `poll.fdMutex`
C2	`gintmapnetfilereadopensyncpipestat.com, exec.in`

XWorm — Profil du malware

XWorm RAT .NET. Contract.exe is sozlesmesi. RecargarPanels Ispanyolca UI. panelActions plugin. Aggregate modül.

Type de malware

RAT

Langage de programmation

.NET C#

Protocole C2

TCP

Systèmes ciblés

Windows

Détails techniques

C# .NET, AES-128-CBC veya AES-256, TCP varsayilan port 7878, Anti-VM (GetSystemFirmwareTable), Anti-debug (FindWindow Olly/x64dbg), Webhook stealer, Clipper, HVNC, Remote Shell, Ransomware modulu

Capacités et comportement

Uzaktan Erişim & Kontrol

Keylogger

Ekran Görüntüsü

Webcam Erişimi

Dosya Yönetimi

Süreç Yönetimi

Komut Yürütme

Kalıcılık Mekanizması

Liste IOC (12 indicateurs)

IOC — XWorm

# 
3ZbgzNTCgCow6uoRELrkntijTnGjw 

# 
3zqwnz3AwEVPhPH1YxVvD5SpyJR3zT6PFY 

# 
32H83gVkH7QwjfbWM8mAjJ7BFoRxjc 

# 
3AJgwjRhQEQwhsG8RnWeFHpZCR5xDU 

# 
35JwwvShAE7LWS5AnqXeFc55GRZ5nY 

# DOMAIN
gintmapnetfilereadopensyncpipestat.com 

# DOMAIN
exec.in 

# MUTEX
eq.sync.RWMutex 

# MUTEX
eq.sync.Mutex 

# MUTEX
sync.runtime_SemacquireMutex 

# MUTEX
runtime.mutex 

# MUTEX
poll.fdMutex

Type	Valeur	Note
	3ZbgzNTCgCow6uoRELrkntijTnGjw	BTC
	3zqwnz3AwEVPhPH1YxVvD5SpyJR3zT6PFY	BTC
	32H83gVkH7QwjfbWM8mAjJ7BFoRxjc	BTC
	3AJgwjRhQEQwhsG8RnWeFHpZCR5xDU	BTC
	35JwwvShAE7LWS5AnqXeFc55GRZ5nY	BTC
domain	gintmapnetfilereadopensyncpipestat.com	C2 domain
domain	exec.in	C2 domain
mutex	eq.sync.RWMutex	Mutex
mutex	eq.sync.Mutex	Mutex
mutex	sync.runtime_SemacquireMutex	Mutex
mutex	runtime.mutex	Mutex
mutex	poll.fdMutex	Mutex

XWorm — Voir le profil complet →

Serveurs C2 (8 serveurs enregistrés pour cette famille)

Adresse	Type	Port	Protocole	Statut	Pays
eIL.ru	domain	—	TCP	active	—
exec.in	domain	—	TCP	active	—
exec.in	domain	—	TCP	active	—
exec.in	domain	—	TCP	active	—
exec.in	domain	—	TCP	active	—
github.com	domain	—	TCP	active	—
system.io	domain	—	TCP	inactive	—
system.io	domain	—	TCP	inactive	—

Les adresses C2 proviennent uniquement d'échantillons de malwares vérifiés manuellement par l'équipe KEYDAL. Toute utilisation commerciale est interdite.