General

  • Target

    240328-b3jvvscg2w

  • Size

    95KB

  • Sample

    240328-eh4ajsbf57

  • MD5

    78da80f828aa97105adae3e5c28dfbfc

  • SHA1

    3e24eeb56cdb87f92ef3827487b6340be530c13e

  • SHA256

    3a4cab2ddcd3d404a46bc4545feb4422937bbb2ba550bfdd02577de41d0180bb

  • SHA512

    53ebf27a9b54a3205df517434fbd38ce5d3487420f12730f018fe6ce625365f76b1cf8744e16a8e242e64534431c60a8ad1019818ea2dfd4ab040681d43bed29

  • SSDEEP

    1536:h6Bdta8gOgdQpwaYbR6dXxkeVQdeEtJOEyEeUVx2B7xC0659FLjk8i9CUi/:h6Bdta8gzCFwwXmwY1QEyI2reHN8CUw

Malware Config

Extracted

Family

xworm

Attributes
  • Install_directory

    %AppData%

  • install_file

    XClient.exe

Targets

    • Target

      240328-b3jvvscg2w

    • Size

      95KB

    • MD5

      78da80f828aa97105adae3e5c28dfbfc

    • SHA1

      3e24eeb56cdb87f92ef3827487b6340be530c13e

    • SHA256

      3a4cab2ddcd3d404a46bc4545feb4422937bbb2ba550bfdd02577de41d0180bb

    • SHA512

      53ebf27a9b54a3205df517434fbd38ce5d3487420f12730f018fe6ce625365f76b1cf8744e16a8e242e64534431c60a8ad1019818ea2dfd4ab040681d43bed29

    • SSDEEP

      1536:h6Bdta8gOgdQpwaYbR6dXxkeVQdeEtJOEyEeUVx2B7xC0659FLjk8i9CUi/:h6Bdta8gzCFwwXmwY1QEyI2reHN8CUw

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

    • Detects Windows executables referencing non-Windows User-Agents

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Adds Run key to start application

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v15

Tasks