General
-
Target
Vbucks-gen.exe
-
Size
229KB
-
Sample
240428-gyhd5ahh91
-
MD5
6b8f6f416051d2947c802eeb3710077b
-
SHA1
02f986ff007d5867d1d638f72c61e7231c0374d2
-
SHA256
05026b12b16aa7ffb8aa35c47e1d967b17459eb313f443dfaffd528842df5ba2
-
SHA512
0ea970a737ca8d49af5d1008eb254027d939aea1d98af5b8bdae2b092279c2420b1c52f49becda0f23f955e02fbf33c4a78af74935cf94743f553bad6db64480
-
SSDEEP
3072:y85g8Zl3CCzlgJQmzcAkWENrrlKVAvYkzQfQj7oIhGwubdjdhO9dRgeX77fizS:jpZlSIWpqnloO9oqgbLsAeX3az
Behavioral task
behavioral1
Sample
Vbucks-gen.exe
Resource
win7-20240221-en
Malware Config
Extracted
xworm
192.168.0.197:9999
7u0t4YhJyvkbGmU0
-
install_file
USB.exe
Targets
-
-
Target
Vbucks-gen.exe
-
Size
229KB
-
MD5
6b8f6f416051d2947c802eeb3710077b
-
SHA1
02f986ff007d5867d1d638f72c61e7231c0374d2
-
SHA256
05026b12b16aa7ffb8aa35c47e1d967b17459eb313f443dfaffd528842df5ba2
-
SHA512
0ea970a737ca8d49af5d1008eb254027d939aea1d98af5b8bdae2b092279c2420b1c52f49becda0f23f955e02fbf33c4a78af74935cf94743f553bad6db64480
-
SSDEEP
3072:y85g8Zl3CCzlgJQmzcAkWENrrlKVAvYkzQfQj7oIhGwubdjdhO9dRgeX77fizS:jpZlSIWpqnloO9oqgbLsAeX3az
-
Detect Xworm Payload
-
Drops startup file
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-