General
-
Target
nursultan crack.exe
-
Size
36KB
-
Sample
240522-k7zasaae21
-
MD5
4a39cd1b911d7237d3ad198245501e5a
-
SHA1
b7eaab3752df42f759d198ea9de719a3c76ffc67
-
SHA256
7499661b53d56a269ee1ff6817a8449120735f015c16d76f1edb74114f9343a2
-
SHA512
1627b3e893721c0530aba12a7d93a0ad34ad94ffdc5f5e1ad93b82e245d59cfdb0881de4ae186b9a321ad391984d0ba489dca4881ed45633039c31412da8d871
-
SSDEEP
768:OTAJM/jPWzJzGMpFALFyn9CUIOjhaD2j:OEsjO1eFU9CHOjt
Malware Config
Extracted
xworm
5.0
remove-woman.gl.at.ply.gg:53860:5915
J3OlWpD2zCDTeEld
-
Install_directory
%AppData%
-
install_file
XClient.exe
Targets
-
-
Target
nursultan crack.exe
-
Size
36KB
-
MD5
4a39cd1b911d7237d3ad198245501e5a
-
SHA1
b7eaab3752df42f759d198ea9de719a3c76ffc67
-
SHA256
7499661b53d56a269ee1ff6817a8449120735f015c16d76f1edb74114f9343a2
-
SHA512
1627b3e893721c0530aba12a7d93a0ad34ad94ffdc5f5e1ad93b82e245d59cfdb0881de4ae186b9a321ad391984d0ba489dca4881ed45633039c31412da8d871
-
SSDEEP
768:OTAJM/jPWzJzGMpFALFyn9CUIOjhaD2j:OEsjO1eFU9CHOjt
-
Detect Xworm Payload
-
Drops startup file
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-