General
-
Target
23vcD1orbL.exe
-
Size
1.3MB
-
Sample
240402-xrvc4saf72
-
MD5
d48c30f50906d73b06aabec4a3c0ef96
-
SHA1
4ed2965e2c48d3e35a3e4e1ea8781d3761de94a5
-
SHA256
71015901a4bbe9f7f81a3f899bf7c21ceca2a332e272e31a4d6d2b6b4f71a59f
-
SHA512
71eb7ca54f7f1019716c9e5a323d0ffa892a6485fe387044deb9fe431e809bd2f8be5e35f3aba185eb53d437fc63a5a66704815b612e6ea960220610d459265f
-
SSDEEP
1536:c/G4iM3eweCmtR8K/ddBNm/LBOK+kAYxQb1biW3+FQxEfOO701d67/fxU9:cOrZ8kyt3AYeb1WRSEfO1vd9
Behavioral task
behavioral1
Sample
23vcD1orbL.exe
Resource
win7-20240319-en
Malware Config
Extracted
xworm
-
Install_directory
%ProgramData%
-
install_file
svchost.exe
-
pastebin_url
https://pastebin.com/raw/z5PQ82wE
Targets
-
-
Target
23vcD1orbL.exe
-
Size
1.3MB
-
MD5
d48c30f50906d73b06aabec4a3c0ef96
-
SHA1
4ed2965e2c48d3e35a3e4e1ea8781d3761de94a5
-
SHA256
71015901a4bbe9f7f81a3f899bf7c21ceca2a332e272e31a4d6d2b6b4f71a59f
-
SHA512
71eb7ca54f7f1019716c9e5a323d0ffa892a6485fe387044deb9fe431e809bd2f8be5e35f3aba185eb53d437fc63a5a66704815b612e6ea960220610d459265f
-
SSDEEP
1536:c/G4iM3eweCmtR8K/ddBNm/LBOK+kAYxQb1biW3+FQxEfOO701d67/fxU9:cOrZ8kyt3AYeb1WRSEfO1vd9
-
Detect Xworm Payload
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-