{"id":1086,"date":"2021-12-01T12:17:37","date_gmt":"2021-12-01T12:17:37","guid":{"rendered":"https:\/\/threats.amnpardaz.com\/en\/?p=1086"},"modified":"2024-02-14T11:49:56","modified_gmt":"2024-02-14T11:49:56","slug":"hacktool-win32-xwo-a","status":"publish","type":"post","link":"https:\/\/threats.amnpardaz.com\/en\/2021\/12\/01\/hacktool-win32-xwo-a\/","title":{"rendered":"Hacktool.Win32.Xwo.a"},"content":{"rendered":"

Overview<\/h2>\n

Type:<\/strong> Hacktool<\/p>\n

Destruction Level:<\/strong> High<\/p>\n

Prevalence:<\/strong> Low<\/p>\n

 <\/p>\n

What is Hacktool?<\/h3>\n

Hacktools are tools designed to facilitate intrusion. These tools can be used by a hacker to siphon data from the victim organization’s network. These tools are commonly used to retrieve the validation information of sensitive victim servers. For example, a hacker can use tools to guess passwords using Hacktool based on Brute Force attacks. In some cases, to increase access levels and exploit existing vulnerabilities, HackTools are used. In general, hacking tools can crash the computer and network security barriers and provide various capabilities to infiltrate systems.<\/p>\n

What is Xwo malware?<\/h3>\n

Xwo Is a Python-based robot that utilizes default web services and scans passwords in the ftp \u060cmysql \u060cpostgresql \u060cmongodb \u060credis \u060cmemcached \u060cTomcat \u060cphpMyAdmin \u060cVNC And RSYNC forms. The name of this tool is derived from the name of its main module. Xbash and MongoLock malware use this Hacktool as a tool to extract information. After finding the desired passwords, the malware sends them to its Commands and Control Server.<\/p>\n

Technical Explanation<\/h2>\n

MongoLock ransomware attacks MongoDB servers and extorts users to retrieve the data. Xwo And MongoLock Both use the same Python-based code and overlap in C2 infrastructure. Unlike MongoLock, the Xwo tool has no ransomware capability but sends the stolen information to its C2 server.<\/p>\n

Signs of infection<\/h3>\n

Signs of infection include network connections. The malware is trying to connect to the following addresses:
\n\u2022 s [.] propub3r6espa33w [.] tk
\n\u2022 s [.] Blockchainbdgpzk [.] Tk
\n\u2022 s [.] Pcrisk [.] Xyz
\n\u2022 s [.] Rapid7 [.] Xyz<\/p>\n

Description<\/h3>\n

This tool first scans the network range provided by the command and control server. It then begins to gather information. First, it requests an HTTP POST with a User-Agent from a random list of coded options. This scanner uses encrypted code to obtain a list of command and control servers:<\/p>\n

\"1-Hacktool.Win32.Xwo.a\"<\/p>\n

Xwo aimed to check default passwords in MySQL \u060cPostgreSQL \u060cMongoDB \u060cRedis and Memcached databases. As shown in the image below, the code of this tool contains a dictionary of weak and known passwords so that if the user’s password matches one of them, it will send it to the server.<\/p>\n

\"\"<\/h4>\n

If it finds an Apache Tomcat scanner in the system, it uses a module to check for improper configuration and default passwords. Additional information such as default routes SVN \u060cGit and backups are also collected.
\nExample of validation test modules for tomcat:<\/p>\n

\"\"
\nList of ports used for targeted malware:<\/h4>\n

\"4-Hacktool.Win32.Xwo.a\"<\/p>\n

How to deal with it and disinfect the system<\/h2>\n

Padvish Antivirus<\/a> detects this malware and removes it from the system. Also, some policy implementations can prevent these attacks to the maximum. The most critical security measures to be taken in any network are as follows:<\/p>\n