Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://oxy.name/d/AeSh
Resource
win10-20240404-en
15 signatures
300 seconds
Behavioral task
behavioral2
Sample
https://oxy.name/d/AeSh
Resource
win10v2004-20240508-en
8 signatures
300 seconds
Malware Config
Extracted
Family
xworm
C2
central-feb.gl.at.ply.gg:50764
wiz.bounceme.net:6000
Attributes
-
Install_directory
%AppData%
-
install_file
USB.exe
aes.plain
Targets
-
-
Detect Xworm Payload
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Downloads MZ/PE file
-
Executes dropped EXE
-