XWorm — e6214ec3dc86e8aa709720e5fedaee79fd70b8dc0e25fcadd80ecdde63b50451.exe [e6214ec3]

Statik Analiz — XWorm | YÜKSEK | CVSS: 7.5

Dosya

SHA256	`e6214ec3dc86e8aa709720e5fedaee79fd70b8dc0e25fcadd80ecdde63b50451`
MD5	`a1ea911e1a52877455cd62ba133a675b`
Dosya	e6214ec3dc86e8aa709720e5fedaee79fd70b8dc0e25fcadd80ecdde63b50451.exe
Boyut	4,166,656 byte
Tür	PE32+ executable for MS Windows 6.01 (GUI), x86-64, 8 sections
Stringler	5,643

Bölümler

Ad	Entropi
`.text`	6.23
`.rdata`	6.42
`.data`	3.96
`.pdata`	4.96
`.xdata`	1.78
`.idata`	4.0
`.reloc`	5.4
`.symtab`	0.02

Import Tablosu

kernel32.dll

IOC

SHA256	`e6214ec3dc86e8aa709720e5fedaee79fd70b8dc0e25fcadd80ecdde63b50451`
MD5	`a1ea911e1a52877455cd62ba133a675b`
Domain	`gintmapnetfilereadopensyncpipestat.com`, `exec.in`
BTC	`3ZbgzNTCgCow6uoRELrkntijTnGjw`, `3zqwnz3AwEVPhPH1YxVvD5SpyJR3zT6PFY`, `32H83gVkH7QwjfbWM8mAjJ7BFoRxjc`, `3AJgwjRhQEQwhsG8RnWeFHpZCR5xDU`, `35JwwvShAE7LWS5AnqXeFc55GRZ5nY`
Mutex	`eq.sync.RWMutex`, `eq.sync.Mutex`, `sync.runtime_SemacquireMutex`, `runtime.mutex`, `poll.fdMutex`
C2	`gintmapnetfilereadopensyncpipestat.com, exec.in`

XWorm — Malware Profile

XWorm RAT .NET. Contract.exe is sozlesmesi. RecargarPanels Ispanyolca UI. panelActions plugin. Aggregate modül.

Malware Type

RAT

Programming Language

.NET C#

C2 Protocol

TCP

Target Systems

Windows

Technical Details

C# .NET, AES-128-CBC veya AES-256, TCP varsayilan port 7878, Anti-VM (GetSystemFirmwareTable), Anti-debug (FindWindow Olly/x64dbg), Webhook stealer, Clipper, HVNC, Remote Shell, Ransomware modulu

Capabilities & Behavior

Uzaktan Erişim & Kontrol

Keylogger

Ekran Görüntüsü

Webcam Erişimi

Dosya Yönetimi

Süreç Yönetimi

Komut Yürütme

Kalıcılık Mekanizması

IOC List (12 indicators)

IOC — XWorm

# 
3ZbgzNTCgCow6uoRELrkntijTnGjw 

# 
3zqwnz3AwEVPhPH1YxVvD5SpyJR3zT6PFY 

# 
32H83gVkH7QwjfbWM8mAjJ7BFoRxjc 

# 
3AJgwjRhQEQwhsG8RnWeFHpZCR5xDU 

# 
35JwwvShAE7LWS5AnqXeFc55GRZ5nY 

# DOMAIN
gintmapnetfilereadopensyncpipestat.com 

# DOMAIN
exec.in 

# MUTEX
eq.sync.RWMutex 

# MUTEX
eq.sync.Mutex 

# MUTEX
sync.runtime_SemacquireMutex 

# MUTEX
runtime.mutex 

# MUTEX
poll.fdMutex

Type	Value	Note
	3ZbgzNTCgCow6uoRELrkntijTnGjw	BTC
	3zqwnz3AwEVPhPH1YxVvD5SpyJR3zT6PFY	BTC
	32H83gVkH7QwjfbWM8mAjJ7BFoRxjc	BTC
	3AJgwjRhQEQwhsG8RnWeFHpZCR5xDU	BTC
	35JwwvShAE7LWS5AnqXeFc55GRZ5nY	BTC
domain	gintmapnetfilereadopensyncpipestat.com	C2 domain
domain	exec.in	C2 domain
mutex	eq.sync.RWMutex	Mutex
mutex	eq.sync.Mutex	Mutex
mutex	sync.runtime_SemacquireMutex	Mutex
mutex	runtime.mutex	Mutex
mutex	poll.fdMutex	Mutex

XWorm — Go to Full Profile →

C2 Servers (8 recorded servers for this family)

Address	Type	Port	Protocol	Status	Country
system.io	domain	—	TCP	active	—
eIL.ru	domain	—	TCP	active	—
exec.in	domain	—	TCP	active	—
system.io	domain	—	TCP	active	—
system.io	domain	—	TCP	active	—
system.io	domain	—	TCP	active	—
system.io	domain	—	TCP	active	—
system.io	domain	—	TCP	active	—

C2 addresses are provided only from malware samples manually verified by the KEYDAL team. Commercial use is prohibited.