General
-
Target
multi_tools_v4.exe
-
Size
48KB
-
Sample
240526-bnjljsab78
-
MD5
586cb5dd073416d031a67baebc629fc3
-
SHA1
df744c4909ad37b1375d1e85ef31bf49a203cbc5
-
SHA256
746d5338eb74fc49537083396a933a6c0f11ee921992e3404a45fc2891a48cd8
-
SHA512
fd9f8a5f110bc6fcd2bf93f6d52e1605111bac4891fcce3fb6581df4dbcc192606ebfaf69c7cf9553d0f05535ffc158816a7ef2b07a1164d4ca8817c4ac285c0
-
SSDEEP
768:Lilm2Vb4m8cKGIF0QwSuR3ZRenlxoRi+IbLsFNt9p2Lk6iOAhtHVXy+T3q:Lilmmb4xcKcH3ZRY+IcFf9ULk6iOAzV0
Behavioral task
behavioral1
Sample
multi_tools_v4.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
multi_tools_v4.exe
Resource
win10v2004-20240426-en
Malware Config
Extracted
xworm
5.0
Thecoolboi991-51392.portmap.io:8080
oZ7J5OWLjx16hjLt
-
Install_directory
%AppData%
-
install_file
XClient.exe
Targets
-
-
Target
multi_tools_v4.exe
-
Size
48KB
-
MD5
586cb5dd073416d031a67baebc629fc3
-
SHA1
df744c4909ad37b1375d1e85ef31bf49a203cbc5
-
SHA256
746d5338eb74fc49537083396a933a6c0f11ee921992e3404a45fc2891a48cd8
-
SHA512
fd9f8a5f110bc6fcd2bf93f6d52e1605111bac4891fcce3fb6581df4dbcc192606ebfaf69c7cf9553d0f05535ffc158816a7ef2b07a1164d4ca8817c4ac285c0
-
SSDEEP
768:Lilm2Vb4m8cKGIF0QwSuR3ZRenlxoRi+IbLsFNt9p2Lk6iOAhtHVXy+T3q:Lilmmb4xcKcH3ZRY+IcFf9ULk6iOAzV0
Score10/10-
Detect Xworm Payload
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-