General
-
Target
bff960d935c5481acd7d9b9abb579285.bin
-
Size
84.5MB
-
Sample
240329-d1awaage7v
-
MD5
bff960d935c5481acd7d9b9abb579285
-
SHA1
067b6aec78ab3a9b24b3f2d2bdff0ff4ab04b871
-
SHA256
e47ca89c0722a13b8ecbce34000a507024f87cafdd2d2cd85039e15e3e80d2b3
-
SHA512
09cac681534816a9c45c6977cba013c2759dc523b791b9dd26090e5e3d65602ab15daee4070ef828a41ef3ffa903ae66180008445cd81ac86c8ca8d5d209a56e
-
SSDEEP
1572864:+MTjwE0o6zielRvuo2/aOZNJH3GXN0tsxjjhYoWd0b+LYvRnjo4V4TeUDd/B:+MTj0o6zJlRvuJ/aS3H3YUshWl6M4C9
Static task
static1
Behavioral task
behavioral1
Sample
bff960d935c5481acd7d9b9abb579285.exe
Resource
win7-20240221-en
Malware Config
Extracted
xworm
operations-longer.gl.at.ply.gg:9839
-
Install_directory
%AppData%
-
install_file
XClient.exe
Targets
-
-
Target
bff960d935c5481acd7d9b9abb579285.bin
-
Size
84.5MB
-
MD5
bff960d935c5481acd7d9b9abb579285
-
SHA1
067b6aec78ab3a9b24b3f2d2bdff0ff4ab04b871
-
SHA256
e47ca89c0722a13b8ecbce34000a507024f87cafdd2d2cd85039e15e3e80d2b3
-
SHA512
09cac681534816a9c45c6977cba013c2759dc523b791b9dd26090e5e3d65602ab15daee4070ef828a41ef3ffa903ae66180008445cd81ac86c8ca8d5d209a56e
-
SSDEEP
1572864:+MTjwE0o6zielRvuo2/aOZNJH3GXN0tsxjjhYoWd0b+LYvRnjo4V4TeUDd/B:+MTj0o6zJlRvuJ/aS3H3YUshWl6M4C9
-
Detect Xworm Payload
-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1