General
-
Target
Steam.exe
-
Size
80KB
-
Sample
240523-st63gafg57
-
MD5
925c5ac8505847f51b4dbef340716238
-
SHA1
ecfb0b836deb64fa714f0cfc7f41e0f68e85c762
-
SHA256
926ba0df92e1f9b1841c1b04e4d101cbc3ce9c8019f6ac3c717380cd85643f92
-
SHA512
0780eb215f0caee0d63dddbceffb37c498729024957db8347f8df26a2a1df26138275bebfdd595f29549e2c775cd226c9980850daced72809e0b148e1b4c84c6
-
SSDEEP
1536:+v1oTUiT1jJuO+uSjic+b7LIafbVe66xFtOGZPSUQ:ASXu6Sj1+b7EeAtOG4N
Behavioral task
behavioral1
Sample
Steam.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
Steam.exe
Resource
win10v2004-20240508-en
Malware Config
Extracted
xworm
help-wt.gl.at.ply.gg:60294
-
Install_directory
%AppData%
-
install_file
Steam.exe
Targets
-
-
Target
Steam.exe
-
Size
80KB
-
MD5
925c5ac8505847f51b4dbef340716238
-
SHA1
ecfb0b836deb64fa714f0cfc7f41e0f68e85c762
-
SHA256
926ba0df92e1f9b1841c1b04e4d101cbc3ce9c8019f6ac3c717380cd85643f92
-
SHA512
0780eb215f0caee0d63dddbceffb37c498729024957db8347f8df26a2a1df26138275bebfdd595f29549e2c775cd226c9980850daced72809e0b148e1b4c84c6
-
SSDEEP
1536:+v1oTUiT1jJuO+uSjic+b7LIafbVe66xFtOGZPSUQ:ASXu6Sj1+b7EeAtOG4N
Score10/10-
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Detect Xworm Payload
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-