Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
XClient.exe
-
Size
43KB
-
Sample
240605-vd4zaadc24
-
MD5
9a6ce16635ceb90281c16062ae68a06c
-
SHA1
319ee0e49c3a23cf6afa7cb34d358247b6fbc89e
-
SHA256
f9a8f2e29dc5966bcb6f5a9b118a0e2cb2807619d9ce16dbb18e71737bf44ac8
-
SHA512
ec1e632a6efc0c8aa20386c3925a3b3a2941a33992d788de6d5a777a10c267e073b57d8a95af3d00684b0c4c33efb060f1d126c95179de731a19c71da36eb589
-
SSDEEP
768:ZY8ErOTKMYpyyNRyjymZ49pnWwFFEPh9Cf66FOChtk2lHxfgm:6/OUTc6Fw9y66FOCIwRt
Behavioral task
behavioral1
Sample
XClient.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
XClient.exe
Resource
win7-20240215-en
Behavioral task
behavioral3
Sample
XClient.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral4
Sample
XClient.exe
Resource
win11-20240426-en
Malware Config
Extracted
xworm
3.0
lunassworld-50930.portmap.host:5508
tBgRQhKX6pJuMKdy
-
Install_directory
%AppData%
-
install_file
USB.exe
Targets
-
-
Target
XClient.exe
-
Size
43KB
-
MD5
9a6ce16635ceb90281c16062ae68a06c
-
SHA1
319ee0e49c3a23cf6afa7cb34d358247b6fbc89e
-
SHA256
f9a8f2e29dc5966bcb6f5a9b118a0e2cb2807619d9ce16dbb18e71737bf44ac8
-
SHA512
ec1e632a6efc0c8aa20386c3925a3b3a2941a33992d788de6d5a777a10c267e073b57d8a95af3d00684b0c4c33efb060f1d126c95179de731a19c71da36eb589
-
SSDEEP
768:ZY8ErOTKMYpyyNRyjymZ49pnWwFFEPh9Cf66FOChtk2lHxfgm:6/OUTc6Fw9y66FOCIwRt
Score10/10-
Detect Xworm Payload
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-