General
-
Target
XClient.exe
-
Size
41KB
-
Sample
240530-xk32nshe22
-
MD5
316fe055c2d7f8909097d57c8d37a59a
-
SHA1
5e674edc1a5d8805b4e62b156cffb663f00a60a1
-
SHA256
1986a85fd4e01356bf9319a6081d052a0032ad9062431eb968005808f34c925b
-
SHA512
c774705918d19a95c9ee1fde9df63ac8db45996a44add2bc15911e2862fc68c4a0f97b063ceef1bbf0d33cd77b60932c0220df9697a2feceff28c9bfdb205f2e
-
SSDEEP
768:i+ibOOtImfC0nKgAFm/S8CJF5PM9poc6MOwhd3Ei7:itbv6mKiKgAs/fSFS9Cc6MOwXF7
Behavioral task
behavioral1
Sample
XClient.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
XClient.exe
Resource
win7-20240221-en
Behavioral task
behavioral3
Sample
XClient.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral4
Sample
XClient.exe
Resource
win11-20240508-en
Malware Config
Extracted
xworm
5.0
127.0.0.1:4431
47kDhvQPMS0nDsrT
-
Install_directory
%AppData%
-
install_file
Astral.exe
Targets
-
-
Target
XClient.exe
-
Size
41KB
-
MD5
316fe055c2d7f8909097d57c8d37a59a
-
SHA1
5e674edc1a5d8805b4e62b156cffb663f00a60a1
-
SHA256
1986a85fd4e01356bf9319a6081d052a0032ad9062431eb968005808f34c925b
-
SHA512
c774705918d19a95c9ee1fde9df63ac8db45996a44add2bc15911e2862fc68c4a0f97b063ceef1bbf0d33cd77b60932c0220df9697a2feceff28c9bfdb205f2e
-
SSDEEP
768:i+ibOOtImfC0nKgAFm/S8CJF5PM9poc6MOwhd3Ei7:itbv6mKiKgAs/fSFS9Cc6MOwXF7
Score10/10-
Detect Xworm Payload
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-