General
-
Target
Xclient.exe
-
Size
81KB
-
Sample
240530-l5ec9sdg8v
-
MD5
920858512e4722a649ca6bdecf4ea1a6
-
SHA1
76019c1408ef7c7ea5fd5f53b58ad21a07b9b483
-
SHA256
f691af29880a23440b65782116124cbdfe8ea9d58ed103f33f15a89b0952b13a
-
SHA512
ec5c1ba5af7253e494e3ccc7e8f2890c308bcb18e33e5e9bb76e631ada244674598a464a49064e5215780e2330b9f9bbdbe208f5f836432d27428270be275018
-
SSDEEP
1536:uzRjUdfuRnFe1zy6rzRTa57tmJWb5t4kOuFA/F6NZfhdcAfzOAwqQkGH:7n1lRsx6Wb5tVLd3zOAweGH
Malware Config
Extracted
xworm
127.0.0.1:4099
-
Install_directory
%AppData%
-
install_file
XClient.exe
Targets
-
-
Target
Xclient.exe
-
Size
81KB
-
MD5
920858512e4722a649ca6bdecf4ea1a6
-
SHA1
76019c1408ef7c7ea5fd5f53b58ad21a07b9b483
-
SHA256
f691af29880a23440b65782116124cbdfe8ea9d58ed103f33f15a89b0952b13a
-
SHA512
ec5c1ba5af7253e494e3ccc7e8f2890c308bcb18e33e5e9bb76e631ada244674598a464a49064e5215780e2330b9f9bbdbe208f5f836432d27428270be275018
-
SSDEEP
1536:uzRjUdfuRnFe1zy6rzRTa57tmJWb5t4kOuFA/F6NZfhdcAfzOAwqQkGH:7n1lRsx6Wb5tVLd3zOAweGH
-
Detect Xworm Payload
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Drops startup file
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-