General
-
Target
SecuriteInfo.com.IL.Trojan.MSILZilla.25629.12905.1460.exe
-
Size
53KB
-
Sample
230323-kfvhhsge3y
-
MD5
64557121d459383777f4c4f5c611e59b
-
SHA1
c59a07cfb7f6268ed914137528fdfa857d20c1d8
-
SHA256
415368c42994976a96d870c801364a58a56ace26be19dab123bb0c45f788c105
-
SHA512
0409479575d93317b62518f028daeba2cabd7f0ccd91389da88c4c076b5adf18c1b9999e5f086393d82ca7c7a0789806d5079d549d2b5e2da0bee4e8484f5d62
-
SSDEEP
1536:5MZ6O2pAM4xs2P0IK5us4o9Fb2WPsM+Ofnxcx4v:Tj2PVK5us4o9FlPsM+OZ
Behavioral task
behavioral1
Sample
SecuriteInfo.com.IL.Trojan.MSILZilla.25629.12905.1460.exe
Resource
win7-20230220-en
Malware Config
Extracted
xworm
jjcDBygdHXnsJ5oY
-
install_file
USBDriver.exe
-
pastebin_url
https://pastebin.com/raw/fB4ZyQEn
Targets
-
-
Target
SecuriteInfo.com.IL.Trojan.MSILZilla.25629.12905.1460.exe
-
Size
53KB
-
MD5
64557121d459383777f4c4f5c611e59b
-
SHA1
c59a07cfb7f6268ed914137528fdfa857d20c1d8
-
SHA256
415368c42994976a96d870c801364a58a56ace26be19dab123bb0c45f788c105
-
SHA512
0409479575d93317b62518f028daeba2cabd7f0ccd91389da88c4c076b5adf18c1b9999e5f086393d82ca7c7a0789806d5079d549d2b5e2da0bee4e8484f5d62
-
SSDEEP
1536:5MZ6O2pAM4xs2P0IK5us4o9Fb2WPsM+Ofnxcx4v:Tj2PVK5us4o9FlPsM+OZ
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-