General
-
Target
9877e05ca5d50564bf61c140926791d50698bbf49f20f35b75c58318328d8167
-
Size
43KB
-
Sample
240419-v4l66aag42
-
MD5
107bb97b9eec3f17ce55c8567199e11c
-
SHA1
4d0b81b5980a6fed47946d8387797824c2c8365b
-
SHA256
9877e05ca5d50564bf61c140926791d50698bbf49f20f35b75c58318328d8167
-
SHA512
9443c61d525e58e711fad1cfaaf74071b30ab12f3fe2f5fbcc4bb38ac82a45eceb0d080cf95157ee9e004771542dc745c9be6a94ab06825aaafa5312cae5aa10
-
SSDEEP
768:RwDOPBvZr2PDyWKPjUdJibMM3PAPwAXX/EroynDHK7yd26GMwgf+:OSPf+yWKj+JOpYPnX4ik+
Behavioral task
behavioral1
Sample
4b9d898379e5dd1d260c1706aa04aa8270994835a523bb83695062d92c830311.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
4b9d898379e5dd1d260c1706aa04aa8270994835a523bb83695062d92c830311.exe
Resource
win10v2004-20240412-en
Malware Config
Extracted
xworm
involved-hurt.gl.at.ply.gg:35238
-
Install_directory
%LocalAppData%
-
install_file
WindowsHealthSystem.exe
Targets
-
-
Target
4b9d898379e5dd1d260c1706aa04aa8270994835a523bb83695062d92c830311.exe
-
Size
70KB
-
MD5
109adf5a32829b151d536e30a81ee96b
-
SHA1
dc23006a97e7d5bc34eedec563432e63ed6a226a
-
SHA256
4b9d898379e5dd1d260c1706aa04aa8270994835a523bb83695062d92c830311
-
SHA512
74e7fb13e195dcf6b8ed0f40c034925c3762b2e0c43c8faede99ce79a4b07966ff5336769db3f9f5bb4c0478cefc879d59b43d5ded5bda3e75d19bd0a1e9e9e5
-
SSDEEP
1536:QeYZA06UMG73jWw9o5zeS6LQR9bAayaIMbckM6mfOWcNFOfab:QfZxfMGTFXS6LQR9bAaZbfsfOPMab
Score10/10-
Detect Xworm Payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Adds Run key to start application
-