Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
21/04/2024, 08:48
240421-kqlncsfg7s 10General
-
Target
XClent.exe
-
Size
183KB
-
Sample
240421-kqlncsfg7s
-
MD5
0e69783c0f4cd6d63fe44ab4ee689a0c
-
SHA1
70407440413d2ee26f0398e486ddbd6e8ea7c6ac
-
SHA256
5d3302a1cec976301d4ba48e0541eea0e76623517a5b6f2c1b913cfe2ebaa8a7
-
SHA512
95c9100bdee8ce3104be40daca0088f484ca2aa3407e7a997fb472259b3d604993cb53e2f011da4299105566285874f1534df8d22a5a2e15e1e9130943b6423e
-
SSDEEP
3072:wfOE6EtuXq/btJOrGOnPRUGKXs+S++7KFSbxeY+qDDrM47I:fE4Xq/bv7GqStKEbxI
Behavioral task
behavioral1
Sample
XClent.exe
Resource
win7-20240221-en
Malware Config
Extracted
xworm
safe-towers.gl.at.ply.gg:30351
-
install_file
USB.exe
Targets
-
-
Target
XClent.exe
-
Size
183KB
-
MD5
0e69783c0f4cd6d63fe44ab4ee689a0c
-
SHA1
70407440413d2ee26f0398e486ddbd6e8ea7c6ac
-
SHA256
5d3302a1cec976301d4ba48e0541eea0e76623517a5b6f2c1b913cfe2ebaa8a7
-
SHA512
95c9100bdee8ce3104be40daca0088f484ca2aa3407e7a997fb472259b3d604993cb53e2f011da4299105566285874f1534df8d22a5a2e15e1e9130943b6423e
-
SSDEEP
3072:wfOE6EtuXq/btJOrGOnPRUGKXs+S++7KFSbxeY+qDDrM47I:fE4Xq/bv7GqStKEbxI
-
Detect Xworm Payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-