General
-
Target
90c52c013f848e753497323f4921ffb9f8e6c3704daad58ea2940426a4da0bd9
-
Size
43KB
-
Sample
240419-v4vhjaag54
-
MD5
9ee88c568c0c2a37f663c1a40cd18bf6
-
SHA1
87b217ba0fc176e17fc6d38fe5558f9a16193542
-
SHA256
90c52c013f848e753497323f4921ffb9f8e6c3704daad58ea2940426a4da0bd9
-
SHA512
9ec1ea914c411a5b6862262ce1f9cdd24a9e7f6faa533725cf70661e29ae6d96d0818d4ae0e715ca8e6088ca17c2ea0915f00b7efff1859f3cdd9046ad3de107
-
SSDEEP
768:PY+O4Yx7gTn4bpx8EAZzP7PVOE3/4X6Ew/sOHS3snzoh3cfrjBj:Qgr4Vx8EAlPVv/4zw/Xzoh3cfrj5
Behavioral task
behavioral1
Sample
4b9d898379e5dd1d260c1706aa04aa8270994835a523bb83695062d92c830311.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
4b9d898379e5dd1d260c1706aa04aa8270994835a523bb83695062d92c830311.exe
Resource
win10v2004-20240412-en
Malware Config
Extracted
xworm
involved-hurt.gl.at.ply.gg:35238
-
Install_directory
%LocalAppData%
-
install_file
WindowsHealthSystem.exe
Targets
-
-
Target
4b9d898379e5dd1d260c1706aa04aa8270994835a523bb83695062d92c830311.exe
-
Size
70KB
-
MD5
109adf5a32829b151d536e30a81ee96b
-
SHA1
dc23006a97e7d5bc34eedec563432e63ed6a226a
-
SHA256
4b9d898379e5dd1d260c1706aa04aa8270994835a523bb83695062d92c830311
-
SHA512
74e7fb13e195dcf6b8ed0f40c034925c3762b2e0c43c8faede99ce79a4b07966ff5336769db3f9f5bb4c0478cefc879d59b43d5ded5bda3e75d19bd0a1e9e9e5
-
SSDEEP
1536:QeYZA06UMG73jWw9o5zeS6LQR9bAayaIMbckM6mfOWcNFOfab:QfZxfMGTFXS6LQR9bAaZbfsfOPMab
Score10/10-
Detect Xworm Payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Adds Run key to start application
-