General
-
Target
Revert_Proxy2.exe
-
Size
50KB
-
Sample
240420-nxjdcsgd91
-
MD5
8ed10249a741529f5ce9ebbcfa50b4ab
-
SHA1
1135d5e4cd03ba57c681016c5c18bda35c7144fd
-
SHA256
a9acd48968fdffc028988d29979a781cc707b96fd1483f7825a1014c89fe9e49
-
SHA512
2700127217546eb248ce086857c1c0fdc6fda3db18576b65dcde7e208c5319c97b782b7459f9f88a67cd1eeea9844dd7083423f903b4c9f25fe108f072ff6409
-
SSDEEP
1536:Wf05a/CTjS89IFc9Uw68OMA3dS1EAd8IIR:Wf05a/CTJ9IFc9UuOMmgEA6IIR
Behavioral task
behavioral1
Sample
Revert_Proxy2.exe
Resource
win7-20240221-en
Malware Config
Extracted
xworm
5.0
85.203.4.127:1474
eBA1hJEKi2fpwXUX
-
Install_directory
%ProgramData%
-
install_file
VLC_Media.exe
Targets
-
-
Target
Revert_Proxy2.exe
-
Size
50KB
-
MD5
8ed10249a741529f5ce9ebbcfa50b4ab
-
SHA1
1135d5e4cd03ba57c681016c5c18bda35c7144fd
-
SHA256
a9acd48968fdffc028988d29979a781cc707b96fd1483f7825a1014c89fe9e49
-
SHA512
2700127217546eb248ce086857c1c0fdc6fda3db18576b65dcde7e208c5319c97b782b7459f9f88a67cd1eeea9844dd7083423f903b4c9f25fe108f072ff6409
-
SSDEEP
1536:Wf05a/CTjS89IFc9Uw68OMA3dS1EAd8IIR:Wf05a/CTJ9IFc9UuOMmgEA6IIR
-
Detect Xworm Payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-