General
-
Target
javaw.exe Java(TM) Platform SE binary.exe
-
Size
66KB
-
Sample
240520-sb7laaee89
-
MD5
52409e4dbf9ed75c7fd6fbb4e7b1593c
-
SHA1
b2124798396292059c64fcb5e3d40a742ea66f0b
-
SHA256
8c63a9bbb49745a61fbf450e78485966222810403844af067f43046092b02112
-
SHA512
b72e769ced2813f5c93731e9c96bdafeb7359c9aa2b23fe9cb8bea675e1c2fcb2a7208b21bf0fc73d8255ee73bb732aea58ff7ff3a14c7727425947fa3f5c1a7
-
SSDEEP
1536:n61arE0YH/pS9OqgM6J0yJbjwe0qsYJcp66/O8J5:8iETfI9OA6J/bML9O8D
Malware Config
Extracted
xworm
lesbian-organ.gl.at.ply.gg:38343
-
Install_directory
%LocalAppData%
-
install_file
javaw.exe Java(TM) Platform SE binary.exe
-
telegram
https://api.telegram.org/bot7026469441:AAEt3_GfOceSfMaQnCWR3hwEjHcRpqL852Q/sendMessage?chat_id=1434801883
Targets
-
-
Target
javaw.exe Java(TM) Platform SE binary.exe
-
Size
66KB
-
MD5
52409e4dbf9ed75c7fd6fbb4e7b1593c
-
SHA1
b2124798396292059c64fcb5e3d40a742ea66f0b
-
SHA256
8c63a9bbb49745a61fbf450e78485966222810403844af067f43046092b02112
-
SHA512
b72e769ced2813f5c93731e9c96bdafeb7359c9aa2b23fe9cb8bea675e1c2fcb2a7208b21bf0fc73d8255ee73bb732aea58ff7ff3a14c7727425947fa3f5c1a7
-
SSDEEP
1536:n61arE0YH/pS9OqgM6J0yJbjwe0qsYJcp66/O8J5:8iETfI9OA6J/bML9O8D
Score10/10-
Detect Xworm Payload
-
XenArmor Suite
XenArmor is as suite of password recovery tools for various application.
-
Xworm
Xworm is a remote access trojan written in C#.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads WinSCP keys stored on the system
Tries to access WinSCP stored sessions.
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads local data of messenger clients
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
Accesses Microsoft Outlook accounts
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-