General
- Target https://cdn.discordapp.com/attachments/1219089729258262558/1219094325187711046/vidos.exe?ex=660a0d10&is=65f79810&hm=31d0e496672ceac39896e1e8f4f3f22744b0539c0a0fbe2ff5c68accf7acdd65&
- Sample240318-ceernsee71
Score
10/10
Malware Config
Extracted
Family
-
xworm
C2
-
ground-gsm.gl.at.ply.gg:17265
Attributes
-
Install_directory
%ProgramData%
-
install_file
WindowsDfender.exe
Extracted
Family
-
quasar
Version
-
1.4.1
Botnet
-
Office04
C2
-
authapi-41985.portmap.host:41985
Mutex
-
50fd280e-bda2-413a-9ebd-86236f4b0beb
Attributes
-
encryption_key
E429F24E279E8B25742D0F5347151B0F90D031CA
-
install_name
system.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
system
-
subdirectory
SubDir
Targets
-
- Target https://cdn.discordapp.com/attachments/1219089729258262558/1219094325187711046/vidos.exe?ex=660a0d10&is=65f79810&hm=31d0e496672ceac39896e1e8f4f3f22744b0539c0a0fbe2ff5c68accf7acdd65&
Score10/10-
Detect Xworm Payload
-
Quasar RAT
Quasar is an open source Remote Access Tool.
-
Quasar payload
-
Xworm
Xworm is a remote access trojan written in C#.
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
An obfuscated cmd.exe command-line is typically used to evade detection.