Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
SantosExecutorInstaller.exe
-
Size
161KB
-
Sample
240508-r86jtacc36
-
MD5
d8a8dc5751ec1e003029b24096414d84
-
SHA1
e5d475f57565aca29bf2111bb123434b66093d8d
-
SHA256
84ed4eecc481a190525ff964da9b2e17eb46b5cd6c45d2c602c5216099e91675
-
SHA512
02ae89407380a0adffb05a256e65c3330d4b67463835f43bf036a06398e6a0bcf9afc0724769862209e854fbe7d4c067563c2b26a970214341162b4ed489f41f
-
SSDEEP
3072:eZJHbIqVRWOnhzBz65/M6If+3Js+3JFkKeTnE:SJHbBxBt25
Behavioral task
behavioral1
Sample
SantosExecutorInstaller.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
SantosExecutorInstaller.exe
Resource
win10v2004-20240508-en
Malware Config
Extracted
xworm
introduction-specifications.gl.at.ply.gg:47117
-
Install_directory
%Userprofile%
-
install_file
svchost.exe
-
telegram
https://api.telegram.org/bot7098399942:AAGbBTQcHRRS0fdzPhkmgHxFxRybEnM_OnM
Targets
-
-
Target
SantosExecutorInstaller.exe
-
Size
161KB
-
MD5
d8a8dc5751ec1e003029b24096414d84
-
SHA1
e5d475f57565aca29bf2111bb123434b66093d8d
-
SHA256
84ed4eecc481a190525ff964da9b2e17eb46b5cd6c45d2c602c5216099e91675
-
SHA512
02ae89407380a0adffb05a256e65c3330d4b67463835f43bf036a06398e6a0bcf9afc0724769862209e854fbe7d4c067563c2b26a970214341162b4ed489f41f
-
SSDEEP
3072:eZJHbIqVRWOnhzBz65/M6If+3Js+3JFkKeTnE:SJHbBxBt25
Score10/10-
Detect Xworm Payload
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-