General
-
Target
2866700e111c6960055421edcb533beb33a07fe0309957f199a859a95498ebe9
-
Size
309KB
-
Sample
240526-ysn36aab9w
-
MD5
3c1ae39c416d64729380aac114979c80
-
SHA1
bc558f5162a16843954e2c82c204fe8755f7d90d
-
SHA256
2866700e111c6960055421edcb533beb33a07fe0309957f199a859a95498ebe9
-
SHA512
15397ba84c91da2e1e8e4b56c07faac38ff7e6d93cb230bd9347b1c1dabfe65d5f986a2929b00f38ad1672d42951b297ed4c32f6708ec0fff7e4c0fe038fd6bd
-
SSDEEP
6144:BDGA7a9G+GIIIIIIIhIIIIIIIIIIIIIIIU:JGL
Behavioral task
behavioral1
Sample
2866700e111c6960055421edcb533beb33a07fe0309957f199a859a95498ebe9.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
2866700e111c6960055421edcb533beb33a07fe0309957f199a859a95498ebe9.exe
Resource
win10v2004-20240508-en
Malware Config
Extracted
xworm
5.0
127.0.0.1:1820
182.176.170.74:1820
Gx1yTHIG7gZFF5ch
-
Install_directory
%AppData%
-
install_file
XClient.exe
Targets
-
-
Target
2866700e111c6960055421edcb533beb33a07fe0309957f199a859a95498ebe9
-
Size
309KB
-
MD5
3c1ae39c416d64729380aac114979c80
-
SHA1
bc558f5162a16843954e2c82c204fe8755f7d90d
-
SHA256
2866700e111c6960055421edcb533beb33a07fe0309957f199a859a95498ebe9
-
SHA512
15397ba84c91da2e1e8e4b56c07faac38ff7e6d93cb230bd9347b1c1dabfe65d5f986a2929b00f38ad1672d42951b297ed4c32f6708ec0fff7e4c0fe038fd6bd
-
SSDEEP
6144:BDGA7a9G+GIIIIIIIhIIIIIIIIIIIIIIIU:JGL
Score10/10-
Detect Xworm Payload
-
Detects Windows executables referencing non-Windows User-Agents
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-