General
-
Target
XClient.exe
-
Size
41KB
-
Sample
240521-m3t7dabb3y
-
MD5
5b522e7a43b0f170f3ef1d666ce7f594
-
SHA1
080d60b9d148cfa7965846bf18e6ab70794309d0
-
SHA256
a5d4cab2ad9681643d784f0e8b28a154ead3cf1c561d2943f0c62e7b5aedc7f0
-
SHA512
c81de5a8eff81ab9373d80cf6f6df0f080b2116109875b234fda96a45a21562e05e3019aa3ec2d45ada4642ed3df6a4f3401f5b01d726672ae1dcb50d0b1ba5e
-
SSDEEP
768:tU0MO0OwERFUa+s91Q7fRaYVO8MoJpJIF5PG9nez6vOwh735i6:tU0M/5ET9zvy0Hfo3aFI9ez6vOwh86
Behavioral task
behavioral1
Sample
XClient.exe
Resource
win11-20240508-en
Malware Config
Extracted
xworm
5.0
ljeUfmQVJF65jlmg
-
Install_directory
%ProgramData%
-
install_file
Calculator.exe
-
pastebin_url
https://pastebin.com/raw/8NHjMQQu
Targets
-
-
Target
XClient.exe
-
Size
41KB
-
MD5
5b522e7a43b0f170f3ef1d666ce7f594
-
SHA1
080d60b9d148cfa7965846bf18e6ab70794309d0
-
SHA256
a5d4cab2ad9681643d784f0e8b28a154ead3cf1c561d2943f0c62e7b5aedc7f0
-
SHA512
c81de5a8eff81ab9373d80cf6f6df0f080b2116109875b234fda96a45a21562e05e3019aa3ec2d45ada4642ed3df6a4f3401f5b01d726672ae1dcb50d0b1ba5e
-
SSDEEP
768:tU0MO0OwERFUa+s91Q7fRaYVO8MoJpJIF5PG9nez6vOwh735i6:tU0M/5ET9zvy0Hfo3aFI9ez6vOwh86
Score10/10-
Detect Xworm Payload
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Drops startup file
-
Executes dropped EXE
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Sets desktop wallpaper using registry
-