General
-
Target
qaz.exe
-
Size
48KB
-
Sample
240427-nt92xahg48
-
MD5
676a07c74e4487abada569413214be3f
-
SHA1
82ff0ba18b54f37b3703ea15b3414d735bd50827
-
SHA256
01072fd48095c4819ac6f11317706a90b0e476b3028cb2b0a628834061e03514
-
SHA512
71da9be9e00c19b07ea123a69fa29cc3ce08938f0e82abce58eff3e7c783e1595f1945ea2638bc010860278175694e0dc73b9de356aae1ea2f5e6c8ee1104439
-
SSDEEP
768:a0GwCSArxzUa65wdbDi3TeRb/m9eMF4TLFWt9jCU1A6OOAhx0Xj78ZCn:iZ99R6A9O9fF2FY9jCU1A6OOAv0Egn
Behavioral task
behavioral1
Sample
qaz.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
qaz.exe
Resource
win10v2004-20240419-en
Malware Config
Extracted
xworm
5.0
127.0.0.1:7000
91.92.252.220:7000
41.199.23.195:7000
saveclinetsforme68465454711991.publicvm.com:7000
wgRrsTR2yhDOozrq
-
Install_directory
%AppData%
-
install_file
explorer.exe
-
telegram
https://api.telegram.org/bot2128988424:AAEkYnwvOQA95riqRZwlqBxg4GV-odRNOyo/sendMessage?chat_id=966649672
Targets
-
-
Target
qaz.exe
-
Size
48KB
-
MD5
676a07c74e4487abada569413214be3f
-
SHA1
82ff0ba18b54f37b3703ea15b3414d735bd50827
-
SHA256
01072fd48095c4819ac6f11317706a90b0e476b3028cb2b0a628834061e03514
-
SHA512
71da9be9e00c19b07ea123a69fa29cc3ce08938f0e82abce58eff3e7c783e1595f1945ea2638bc010860278175694e0dc73b9de356aae1ea2f5e6c8ee1104439
-
SSDEEP
768:a0GwCSArxzUa65wdbDi3TeRb/m9eMF4TLFWt9jCU1A6OOAhx0Xj78ZCn:iZ99R6A9O9fF2FY9jCU1A6OOAv0Egn
Score10/10-
Detect Xworm Payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Adds Run key to start application
-