General
-
Target
NursultanLoader.rar
-
Size
36KB
-
Sample
240531-rg47nsba2w
-
MD5
cea6f26249a0c68f46d91d269aec8b75
-
SHA1
79124abc0a6963dab33a5fa9da843e4fd4518d39
-
SHA256
7f7c3b09b23a4147f13f38fcb8592fc2a86db49ee51b580e52641693382b0a6d
-
SHA512
d1580a7db1fee19ba2e39d10c60be8711578c7e6133c3e44123d3c7be770c9b603afd2e72ab1cb251afeb6d34d4691c5c95dd8436ab7450b766a7882eab562d8
-
SSDEEP
768:RjzJu5uGeuNRVmrm5BNQlQloOOYWM9cthsD203yxVzsT:Rhu5e9oN0QSOOC9cID21z+
Behavioral task
behavioral1
Sample
NursultanLoader.exe
Resource
win11-20240426-en
Malware Config
Extracted
xworm
loss-winners.gl.at.ply.gg:1567
-
Install_directory
%AppData%
-
install_file
Expensive 3.1.exe
Targets
-
-
Target
NursultanLoader.exe
-
Size
63KB
-
MD5
3adee1c8284ffa4c948bd53cb4ed8b9e
-
SHA1
15488f0a91896a322ffdc829d9fe2bcb3cfeb319
-
SHA256
61a1e82d71d8b95443c04c37b486b3b56dc9c2931eb10aceb77df00f863be28c
-
SHA512
d9fbe3637219b9b5c53555dbeab64e1c1288acaa4eba727e3e133abf03967b5ea059ae41107ba9960ddd3d629cfca795239baee66b52166ed391d5c81a23924b
-
SSDEEP
1536:N1loX++ZE4J/A/oPXh06NNi+bDvMm4oM6XsVO8Ltxxa:yO+H/BPXh00Q+bDvMHo5sVO8Ls
Score10/10-
Detect Xworm Payload
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Adds Run key to start application
-