General
-
Target
ac1a5d5a120ed45ff8a71828374b83c59dd4bd8e68d68319acf989aebf4297d1
-
Size
50KB
-
Sample
240419-vn422aab58
-
MD5
5d87ea155adb2c7651cffcabee30c5c6
-
SHA1
166597ecc9847168eea8230549e3af129a3b7e3b
-
SHA256
ac1a5d5a120ed45ff8a71828374b83c59dd4bd8e68d68319acf989aebf4297d1
-
SHA512
9dc242888813ec3015ca8dc573eaca3da0d69804a07fe06c9b3c5313687708b5be6bf9513d55e932e5766990d3dc340f649a94d44bebe54895c0609b01738504
-
SSDEEP
1536:N4OX8Gu6g6dX7v15SVjUKBA5Aw3YgRjiWls:hXUmdX7v98iYKiWls
Behavioral task
behavioral1
Sample
574bbc258f00e8ef099184a763b7f03075218c56ebfcd90f0319250cb8cd82ae.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
574bbc258f00e8ef099184a763b7f03075218c56ebfcd90f0319250cb8cd82ae.exe
Resource
win10v2004-20240412-en
Malware Config
Extracted
xworm
3.1
kids-abstract.at.ply.gg:26193
-
Install_directory
%Userprofile%
-
install_file
MSASCuL.exe
-
telegram
https://api.telegram.org/bot6118963747:AAFPoeeAyXiG-pd4NsJhnJCS9gC7YtmGuis/sendMessage?chat_id=5210247710
Targets
-
-
Target
574bbc258f00e8ef099184a763b7f03075218c56ebfcd90f0319250cb8cd82ae.exe
-
Size
80KB
-
MD5
df42a27a39c57d105ca4860a4fe90999
-
SHA1
b9f5c9a013ba4eef11d74927d774765c518511e0
-
SHA256
574bbc258f00e8ef099184a763b7f03075218c56ebfcd90f0319250cb8cd82ae
-
SHA512
2816bcbad66d901d87c22945e71e4a56294b26ebd992ef361778c41a934bad02fa4ce4e5049a0e3097e796ab93514337c24652fb05773e5fdc0c38725510083e
-
SSDEEP
1536:ekmhnAKPZdZ7s66tocAmYvd1Cpt4bU6sVLaRog1f6OO+FcHhrh:FQZPDeptds0t4bUMRog13O+Mrh
Score10/10-
Detect Xworm Payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Adds Run key to start application
-