General

  • Target

    good.exe

  • Size

    71KB

  • Sample

    240328-fd86nsec91

  • MD5

    a3bd6f5e7f2f4e29fe43cbd4414d2d25

  • SHA1

    f478061b3087707befe82eb3cf93b1964fb5153b

  • SHA256

    b8bb137f8b74d60d472c7747b5bb73c4deafcc985481fec1de307794c3370796

  • SHA512

    dad57a21a4571cd40f6540fd2e87b834b85abb5f01e960d534c06c46272c22baa232e2b96d776f5da2d8502a9e5ff85bc9d794382d5336bf2305e89dd9c4c486

  • SSDEEP

    1536:gRToJAGKDVZ4U0KRl92bpjSQVL7jfZ1f36L3OzWcqZ:34Dv4ewbpGyLvfO3OzWHZ

Malware Config

Extracted

Family

xworm

Attributes
  • Install_directory

    %AppData%

  • install_file

    XClient.exe

Targets

    • Target

      good.exe

    • Size

      71KB

    • MD5

      a3bd6f5e7f2f4e29fe43cbd4414d2d25

    • SHA1

      f478061b3087707befe82eb3cf93b1964fb5153b

    • SHA256

      b8bb137f8b74d60d472c7747b5bb73c4deafcc985481fec1de307794c3370796

    • SHA512

      dad57a21a4571cd40f6540fd2e87b834b85abb5f01e960d534c06c46272c22baa232e2b96d776f5da2d8502a9e5ff85bc9d794382d5336bf2305e89dd9c4c486

    • SSDEEP

      1536:gRToJAGKDVZ4U0KRl92bpjSQVL7jfZ1f36L3OzWcqZ:34Dv4ewbpGyLvfO3OzWHZ

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

    • Detects Windows executables referencing non-Windows User-Agents

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v15

Tasks