General

  • Target

    gamesteal.exe

  • Size

    39KB

  • Sample

    240328-sbhxxsaa76

  • MD5

    fc12f1f12395e8bc187def97c53983ec

  • SHA1

    c9ebca9321c038320c7b838fe1059d0c6b05958d

  • SHA256

    1cba206f28135b1c0c826b95a3c8479cbb3ffb00de393b7d74589c99db0abeef

  • SHA512

    5a98195064b837f8a5fb3d210cb894fab5682066f9e67244cfdf2918437a3ab936579029daa901ebfd4f30adb32f440a2aef07d9a2c4ec8b1d96da22ef185464

  • SSDEEP

    768:oNT0Woe2Ntktyd2pwKuukUm2ufFWPt92j6dOMhvalM:oNpo7LIkewKuunsFe92j6dOM1n

Malware Config

Extracted

Family

xworm

Version

5.0

C2

daily-retrieved.gl.at.ply.gg:4200

Mutex

YRFGWIoVsEEZgUB1

Attributes
  • Install_directory

    %Public%

  • install_file

    Runtime Broker.exe

aes.plain

Targets

    • Target

      gamesteal.exe

    • Size

      39KB

    • MD5

      fc12f1f12395e8bc187def97c53983ec

    • SHA1

      c9ebca9321c038320c7b838fe1059d0c6b05958d

    • SHA256

      1cba206f28135b1c0c826b95a3c8479cbb3ffb00de393b7d74589c99db0abeef

    • SHA512

      5a98195064b837f8a5fb3d210cb894fab5682066f9e67244cfdf2918437a3ab936579029daa901ebfd4f30adb32f440a2aef07d9a2c4ec8b1d96da22ef185464

    • SSDEEP

      768:oNT0Woe2Ntktyd2pwKuukUm2ufFWPt92j6dOMhvalM:oNpo7LIkewKuunsFe92j6dOM1n

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks