General

  • Target

    https://mega.nz/file/deNRUCrD#K4Lsn2xr9Z_Dy0fTSa1YtrFskNjvwBsPmxHgNWL5LQg

  • Sample

    240401-yszvnaef55

Malware Config

Extracted

Family

xworm

C2

18.ip.gl.ply.gg:7988

Attributes
  • Install_directory

    %AppData%

  • install_file

    svchost.exe

Targets

    • Target

      https://mega.nz/file/deNRUCrD#K4Lsn2xr9Z_Dy0fTSa1YtrFskNjvwBsPmxHgNWL5LQg

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

    • AgentTesla payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v15

Tasks