General
-
Target
B1OdUv8CBH.exe
-
Size
1.0MB
-
Sample
240427-lsqkrsga33
-
MD5
73a20ee98214059033a93ff5da62d903
-
SHA1
a35422a4969f7d79fc9cf597cf40b7456d5b05d8
-
SHA256
5df7cf7c7d153a0e55b0ca9299d00c26625e70cff3613540c5718fe74e4c7d12
-
SHA512
7c3b08ebbc57467aa3615b14d7ea6f629e03e49c17d6268f62345cc58f4ca9823e45ef101c1e247db354ca944481470f94f9c226bc7774f78da9ad0185a76b47
-
SSDEEP
1536:ZAiYlXZeFi9eKNVlb8i7ZUNQmD4O+HoddUT:anpo2Xb8C8D4OUoET
Malware Config
Extracted
xworm
-
Install_directory
%ProgramData%
-
install_file
svchost.exe
-
pastebin_url
https://pastebin.com/raw/z5PQ82wE
Targets
-
-
Target
B1OdUv8CBH.exe
-
Size
1.0MB
-
MD5
73a20ee98214059033a93ff5da62d903
-
SHA1
a35422a4969f7d79fc9cf597cf40b7456d5b05d8
-
SHA256
5df7cf7c7d153a0e55b0ca9299d00c26625e70cff3613540c5718fe74e4c7d12
-
SHA512
7c3b08ebbc57467aa3615b14d7ea6f629e03e49c17d6268f62345cc58f4ca9823e45ef101c1e247db354ca944481470f94f9c226bc7774f78da9ad0185a76b47
-
SSDEEP
1536:ZAiYlXZeFi9eKNVlb8i7ZUNQmD4O+HoddUT:anpo2Xb8C8D4OUoET
-
Detect Xworm Payload
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-