General
-
Target
B1OdUv8CBH.exe
-
Size
1.0MB
-
Sample
240425-rva6rabe8z
-
MD5
73a20ee98214059033a93ff5da62d903
-
SHA1
a35422a4969f7d79fc9cf597cf40b7456d5b05d8
-
SHA256
5df7cf7c7d153a0e55b0ca9299d00c26625e70cff3613540c5718fe74e4c7d12
-
SHA512
7c3b08ebbc57467aa3615b14d7ea6f629e03e49c17d6268f62345cc58f4ca9823e45ef101c1e247db354ca944481470f94f9c226bc7774f78da9ad0185a76b47
-
SSDEEP
1536:ZAiYlXZeFi9eKNVlb8i7ZUNQmD4O+HoddUT:anpo2Xb8C8D4OUoET
Behavioral task
behavioral1
Sample
B1OdUv8CBH.exe
Resource
win10v2004-20240412-en
Malware Config
Extracted
xworm
-
Install_directory
%ProgramData%
-
install_file
svchost.exe
-
pastebin_url
https://pastebin.com/raw/z5PQ82wE
Targets
-
-
Target
B1OdUv8CBH.exe
-
Size
1.0MB
-
MD5
73a20ee98214059033a93ff5da62d903
-
SHA1
a35422a4969f7d79fc9cf597cf40b7456d5b05d8
-
SHA256
5df7cf7c7d153a0e55b0ca9299d00c26625e70cff3613540c5718fe74e4c7d12
-
SHA512
7c3b08ebbc57467aa3615b14d7ea6f629e03e49c17d6268f62345cc58f4ca9823e45ef101c1e247db354ca944481470f94f9c226bc7774f78da9ad0185a76b47
-
SSDEEP
1536:ZAiYlXZeFi9eKNVlb8i7ZUNQmD4O+HoddUT:anpo2Xb8C8D4OUoET
Score10/10-
Detect Xworm Payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-