Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
XClient.exe
-
Size
67KB
-
Sample
240508-wsqkwage4w
-
MD5
c9cd80d55733208fc06b8b52cddb52dc
-
SHA1
6cc60302d90e7d7661b5b194fa954efacba19d49
-
SHA256
5fb96191ad7394700966c0854e3f1225b8b2989f528ce6993a747ff7a9cf2552
-
SHA512
befca56bfce924e50c11f9d702ab2d6a6e05d55cd4399c4ac37891c1d337a43d05060f5cb9a1600fc4c172f7816fad14bc02e0c8d44eb82b55f61da4812cd0aa
-
SSDEEP
1536:n5ydgkcoaOOTxMH/W0WybZYgmH2r2i6urYiZOenvefZ3:FVxMfwybZ4rYXZOewZ3
Behavioral task
behavioral1
Sample
XClient.exe
Resource
win7-20240220-en
Malware Config
Extracted
xworm
silver-bowl.gl.at.ply.gg:29206
-
Install_directory
%AppData%
-
install_file
XClient.exe
Targets
-
-
Target
XClient.exe
-
Size
67KB
-
MD5
c9cd80d55733208fc06b8b52cddb52dc
-
SHA1
6cc60302d90e7d7661b5b194fa954efacba19d49
-
SHA256
5fb96191ad7394700966c0854e3f1225b8b2989f528ce6993a747ff7a9cf2552
-
SHA512
befca56bfce924e50c11f9d702ab2d6a6e05d55cd4399c4ac37891c1d337a43d05060f5cb9a1600fc4c172f7816fad14bc02e0c8d44eb82b55f61da4812cd0aa
-
SSDEEP
1536:n5ydgkcoaOOTxMH/W0WybZYgmH2r2i6urYiZOenvefZ3:FVxMfwybZ4rYXZOewZ3
-
Detect Xworm Payload
-
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-