General
-
Target
2649ef15cf6004b05c80abd825cd594e.bin
-
Size
42KB
-
Sample
240328-bhny3scd5z
-
MD5
55c2ad4ab1b62937b8978fac99a6e66b
-
SHA1
538970df6155b84e535036669f2b1e4c386f8947
-
SHA256
cc7cf0c410697552614fd56ffc8f26b3048f4f4e8ba5ff84c302f0959e7f0859
-
SHA512
373740088c3c0f4f5e290f7bf7de5d87a800682792c9081cce9556511ae84c31fc27a8513c120dd8974fb46d0592d7eff259f1e8d9b0718c8a1a7d177b7b8bb5
-
SSDEEP
768:0i8ml4xBg5oHFpDIWlFNKMP2QLqaYeNf8LS/mig6qxSTZQWiF7:gkMhHFpD7FIMPQ8UL+dPqCZQ7
Behavioral task
behavioral1
Sample
e6f7963c726231571294a06e1e8b1f03b87684cad8383bb194b957fc685685c2.exe
Resource
win7-20240220-en
Malware Config
Extracted
xworm
3.0
157.254.223.19:8081
i0Yq2Adr82znjD2G
-
Install_directory
%ProgramData%
-
install_file
USB.exe
-
telegram
https://api.telegram.org/bot5498061286:AAEOFPFhizSA_AbkzDV_OWcHlXVsegPpL_c/sendMessage?chat_id=1267602057
Targets
-
-
Target
e6f7963c726231571294a06e1e8b1f03b87684cad8383bb194b957fc685685c2.exe
-
Size
148KB
-
MD5
2649ef15cf6004b05c80abd825cd594e
-
SHA1
2593cb7db276d90d51ea5235eb4c14cbd8ecd5a5
-
SHA256
e6f7963c726231571294a06e1e8b1f03b87684cad8383bb194b957fc685685c2
-
SHA512
3b1367d52cb5f99bce35fee1d6414de92a9f10e8df6dfd27c6872e5c4783eba9bd0ed5a6d645fd93b81a064f46a00e25fa6d8404e2881f3006f8b04f2ad67ddc
-
SSDEEP
1536:RQuj357A7FK9fYP063O+xrBOybBYfOS4J+1oEhyiHn:quj5wFK9fYPJO+XtYmS4g+Ehfn
-
Detect Xworm Payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-