xworm

Resubmissions

18/06/2024, 11:01

240618-m4tx1a1ajf10

18/06/2024, 10:58

240618-m272vavclm10

18/06/2024, 10:54

240618-mz16hszgnb3

Sharing

Copy URL Twitter E-mail

General

Target
Electron V3.1.zip
Size 14.8MB
Sample240618-m4tx1a1ajf
SHA256 241db2a17ac329619da483ffaab8b2991eaeeae88c2c28f86a0d7aacb3bd16a9
MD5 37bcf3d343fc8a843756d76850dd1a20
SHA1 ac1ec2715968004ac434fe31ed75af521fe97838
SHA512 c560ee805a087589c51f62969d6bfee212f15041b7b9317198c78b8e933b0a26662f30ef22576a8757da286a1d8c66d1582bebbc26e19b002ee8a41a67402b76
SSDEEP 393216:g3IcHTVAGVJ1nukmFRCWtwsewos28WgDRv3NVsyb68:8IcHxAO3rmjz2KJNf3
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

xworm

courses-disney.gl.at.ply.gg:21335
127.0.0.1:21335

Attributes

Install_directory
%AppData%
install_file
svchost.exe
telegram
https://api.telegram.org/bot7006468177:AAEjUyc53owWdXWMasYo_ZE1Y7t2sH1O718/sendMessage?chat_id=809478226

Targets

- Target
  Electron V3.1/Electron V3.exe
- Size 7.1MB
- SHA256 b15e79c502e39a0502c37f4e087ba614b096b0ecd9c39aeebba9415941350eac
- MD5 fe184c85f884ef9a8f5bc56af80073b3
- SHA1 3db462e1f2ed4d9c2bf95dad3aa1c32b395a679b
- SHA512 c4096ae3f65a215c756972688144fed9bc3ed4ca7155558ba31303df72908df524de982a2d6650e555c527589c40d251073140341526c30bfc57bc628b625684
- SSDEEP 196608:Z2B5I6msTfYsxOLDzUQzz02E7FGpgzmEWSyRy/16aGbl:8W6tDYicDzLz02AzqCm2al
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

xworm discovery execution persistence rat spyware stealer trojan
- Detect Xworm Payload
- Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
behavioral1
- Target
  Electron V3.1/Monaco/Microsoft.Web.WebView2.Core.dll
- Size 488KB
- SHA256 5e7faee6b8230ca3b97ce9542b914db3abbbd1cb14fd95a39497aaad4c1094ca
- MD5 851fee9a41856b588847cf8272645f58
- SHA1 ee185a1ff257c86eb19d30a191bf0695d5ac72a1
- SHA512 cf5c70984cf33e12cf57116da1f282a5bd6433c570831c185253d13463b0b9a0b9387d4d1bf4dddab3292a5d9ba96d66b6812e9d7ebc5eb35cb96eea2741348f
- SSDEEP 12288:W/TcW1virB3ye+iKzORFNgeA+imQ9pRFZNIEJdIElxPrEIgcvLcglxMwCepM1STy:W/1C4I
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral2
- Target
  Electron V3.1/Monaco/Microsoft.Web.WebView2.WinForms.dll
- Size 37KB
- SHA256 50b2e46c99076f6fa9c33e0a98f0fe3a2809a7c647bb509066e58f4c7685d7e6
- MD5 4cf94ffa50fd9bdc0bb93cceaede0629
- SHA1 3e30eca720f4c2a708ec53fd7f1ba9e778b4f95f
- SHA512 dc400518ef2f68920d90f1ce66fbb8f4dde2294e0efeecd3d9329aa7a66e1ab53487b120e13e15f227ea51784f90208c72d7fbfa9330d9b71dd9a1a727d11f98
- SSDEEP 768:SNGbP6+wTftcZDgcEST3p4Jjrjh2jJFSUyauYv1JKia5/Zi/WGQKVu6bRaMBo0wx:OGm+otcZDgcEST3p4JjrjaJFSUyau01U
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral3
- Target
  Electron V3.1/Monaco/Microsoft.Web.WebView2.Wpf.dll
- Size 43KB
- SHA256 1e987b22cd011e4396a0805c73539586b67df172df75e3dded16a77d31850409
- MD5 34ec990ed346ec6a4f14841b12280c20
- SHA1 6587164274a1ae7f47bdb9d71d066b83241576f0
- SHA512 b565015ca4b11b79ecbc8127f1fd40c986948050f1caefdd371d34ed2136af0aabf100863dc6fd16d67e3751d44ee13835ea9bf981ac0238165749c4987d1ae0
- SSDEEP 768:1n/WlAKj4s0TV09797+nXDheteXBxc78OSW3Z8lcDP/ryEH0UBy4JjrD1h2j5h3E:1+msYXR3sZ8lcDP/ryEH0UBy4JjrD1aU
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral4
- Target
  Electron V3.1/Monaco/Newtonsoft.Json.dll
- Size 695KB
- SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
- MD5 195ffb7167db3219b217c4fd439eedd6
- SHA1 1e76e6099570ede620b76ed47cf8d03a936d49f8
- SHA512 56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac
- SSDEEP 12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral5
- Target
  Electron V3.1/Monaco/WebView2Loader.dll
- Size 134KB
- SHA256 28cee166d574b246aa076eb59e24567026c7782f9a70a05b48a61508589e6840
- MD5 7bf24896b80f336c1d16b488f89fef34
- SHA1 50db3c6002a85894f7b960aee1d01b5537a7057b
- SHA512 07a660ab26343cb45602710a2935c6b948c80976de612ac403a6e354f7bedbe56e1e92f95cfb0ffa746625a3da5108c9a796941a0db462621ecb653a752766f0
- SSDEEP 3072:c5i6Uab3sFhPk6vEmG1PU6dLXm2ng3esQDqEt2JljdAC:c5P2e6vERtUyTmHEtmT
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral6
- Target
  Electron V3.1/Monaco/Wpf.Ui.dll
- Size 5.2MB
- SHA256 46cfbe804b29c500ebc0b39372e64c4c8b4f7a8e9b220b5f26a9adf42fcb2aed
- MD5 aead90ab96e2853f59be27c4ec1e4853
- SHA1 43cdedde26488d3209e17efff9a51e1f944eb35f
- SHA512 f5044f2ee63906287460b9adabfcf3c93c60b51c86549e33474c4d7f81c4f86cd03cd611df94de31804c53006977874b8deb67c4bf9ea1c2b70c459b3a44b38d
- SSDEEP 98304:Com1p/B6MvSmaRI+VcDNkq4pmvhAHDfyyrhl:W1HZNkq4p
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral7
- Target
  Electron V3.1/Monaco/api-ms-win-crt-convert-l1-1-0.dll
- Size 24KB
- SHA256 983f4d4c7b7330e7f5f091080c1e81905575ebccd97e11dff8a064979ec8d9b8
- MD5 0485c463cd8d2ae1cbd42df6f0591246
- SHA1 ea634140905078e8f687a031ae919cff23c27e6f
- SHA512 ddf947a1b86c3826859570a3e1d59e4ec4564cfcf25c84841383a4b5f5ad6c2fe618078416aed201fb744d5fbd6c39dab7c1e964dd5e148da018a825fcc0044a
- SSDEEP 384:WruyxWfhWMLm0GfeQ1MgKlx+YY30Jl0huSwp+M:PlRhg8Ihep+M
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral8
- Target
  Electron V3.1/Monaco/api-ms-win-crt-filesystem-l1-1-0.dll
- Size 22KB
- SHA256 ab2158fe6b354fb429f57f374ca25105b44e97edcbdc1b752650d895dadd6fd1
- MD5 1193f810519fbc07beb3ffbad3247fc4
- SHA1 db099628a19b2d34e89028c2e16bc89df28ed78f
- SHA512 3222a10c3be5098aca0211015efe75cfbcd408fd28315acedd016d8f77513f81e207536b072001525965635da39c4aae8ef9f6ad367f5d695de67b1614179353
- SSDEEP 384:W3q6nWm5CpWfhWNLm0Gf3Jl0huSwJ+Ruh91MgKlx+YV:l6nWm5Ce4RVheJUUwg8V
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral9
- Target
  Electron V3.1/Monaco/api-ms-win-crt-heap-l1-1-0.dll
- Size 21KB
- SHA256 2ee3d52640d84ac4f7f7ddfe748f51baa6fd0d492286c781251222420e85ca97
- MD5 a22f9a4cbd701209842b204895fedf37
- SHA1 72fa50160baf1f2ea2adcff58f3f90a77a59d949
- SHA512 903755d4fa6651669295a10e66be8ea223cd8d5ad60ebe06188d8b779fef7e964d0aa26dc5479f14aab655562d3c1ef76b86790fb97f991eaf52da0f70e40529
- SSDEEP 384:WTY3eRWfhWILm0Gf/fReAplx4bZak3Jb1MgKlx+YgW:4GtRCaog8gW
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral10
- Target
  Electron V3.1/Monaco/api-ms-win-crt-locale-l1-1-0.dll
- Size 20KB
- SHA256 c36f5c0ac5d91a8417866dd4d8c670c2192ba83364693e7438282fb8678c3d1e
- MD5 ba17b278fff2c18e34e47562ddde8166
- SHA1 bed762d11b98737fcf1d1713d77345ec4780a8c2
- SHA512 72516b81606ccf836549c053325368e93264fdebc7092e42e3df849a16ccefa81b7156ae5609e227faa7c9c1bf9d68b2ac349791a839f4575728f350dd048f27
- SSDEEP 384:WyWfhWGLm0Gfdx46gl9iFoQ0E642zlxCHj0:ETRg1Goj0
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral11
- Target
  Electron V3.1/Monaco/api-ms-win-crt-math-l1-1-0.dll
- Size 28KB
- SHA256 7c3336c3a50bf3b4c5492c0d085519c040878243e9f7d3ea9f6a2e35c8f1f374
- MD5 c4cac2d609bb5e0da9017ebb535634ce
- SHA1 51a264ce4545a2f0d9f2908771e01e001b4e763e
- SHA512 3b55bdbc5132d05ab53852605afe6ed49f4b3decdde8b11f19a621a78a37d98c7aeaaa8c10bf4565b9b50162816305fa5192ee31950a96dc08ae46bfc6af4ffe
- SSDEEP 384:WSQUbM4Oe59Ckb1hgmLVWfhWFLm0GfBOeAplx4bZe1TTTXZl1OS:vRMq59Bb1jycR5aCUS
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral12
- Target
  Electron V3.1/Monaco/api-ms-win-crt-runtime-l1-1-0.dll
- Size 11KB
- SHA256 b12679d33126d2dcb0cd3625fccf5c3afc40d95c1be36dc55f7471de94929d23
- MD5 894e538fbd29d9af2dac82abbb798aa8
- SHA1 3c28b3063ce80b3fd61e0afc6934e3180f5bef12
- SHA512 32ad7f4ba21c7ec47b374ed776cc1662de23a955a00aab509d9b82a9f4aa4b46580933c3382a1cffa526d93af686013104ca1d8d50ab3bab02a291e64b88a884
- SSDEEP 192:+aajPrpJhhf4AN5/KiZWshWPBBbJz8Gjdv6suAH/7gq:+lbr7vWshWpB7dysuzq
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral13
- Target
  Electron V3.1/Monaco/api-ms-win-crt-stdio-l1-1-0.dll
- Size 26KB
- SHA256 e6a1ef1f7c1957c50a3d9c1d70c0f7b0d8badc7f279cd056eb179dc256bfefda
- MD5 5df2410c0afd30c9a11de50de4798089
- SHA1 4112c5493009a1d01090ccae810500c765dc6d54
- SHA512 8ecb79078d05d5b2a432f511953985b3253d5d43d87709a5795709ee8dbca63c5f1166ed94d8984c13f2ea06adfa7d6b82c6735c23c6e64f2f37a257066864e6
- SSDEEP 384:WnZpFVhXWfhW2Lm0Gfi3RKllGBwLeb+Jl0huSwpSs:a+rRlkLelhepSs
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral14
- Target
  Electron V3.1/Monaco/api-ms-win-crt-string-l1-1-0.dll
- Size 26KB
- SHA256 e71d517e6b7039437e3fc449d8ad12eeeca0d5c8ed1c500555344fd90ddc3207
- MD5 aacade02d7aaf6b5eff26a0e3a11c42d
- SHA1 93b8077b535b38fdb0b7c020d24ba280adbe80c3
- SHA512 e02fcbcb70100f67e65903d8b1a7e6314cabfb0b14797bd6e1c92b7bcb3994a54133e35d16da0a29576145b2783221330591526f856b79a25c0575fc923985a6
- SSDEEP 768:96S5yguNvZ5VQgx3SbwA71IkFD7RwL9il:9l5yguNvZ5VQgx3SbwA71IEVwL9il
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral15
- Target
  Electron V3.1/Monaco/index.html
- Size 9KB
- SHA256 7ea33209aa9e94fb56170ec89b1e9640d9751d75741adfe79b827c1c99f57a3f
- MD5 7f7cf6201f2e8815bc57fa8103579917
- SHA1 87b97213d954daf89b1830afadff2d437b015314
- SHA512 9accdf9d5bb1944e8885657219a3d6db179712e26bbe1c7aed5d39b2a2d9b3fc4a5e4d979e00923de54083777ffef97384b04201bf0e963e216961ef590b31fa
- SSDEEP 192:oI6bXF3Jv/8fbVBg7BH1OYKloqdZGUuJBn2jVBfcNs+TIDQvnoaQLF:6tabVBJjVBd+TI6noaQLF
- MD5 SHA1 SHA512 SSDEEP
Score

6^/10
- Legitimate hosting services abused for malware hosting/C2
behavioral16
- Target
  Electron V3.1/Monaco/libcurl.dll
- Size 522KB
- SHA256 ee94e2201870536522047e6d7fe7b903a63cd2e13e20c8fffc86d0e95361e671
- MD5 e31f5136d91bad0fcbce053aac798a30
- SHA1 ee785d2546aec4803bcae08cdebfd5d168c42337
- SHA512 a1543eb1d10d25efb44f9eaa0673c82bfac5173055d04c0f3be4792984635a7c774df57a8e289f840627754a4e595b855d299070d469e0f1e637c3f35274abe6
- SSDEEP 12288:InAnSwPc/1BzyLmI2MB1MqcUfCKHU1XAfK6ae:I6Pc/1BOKtaeqcUaZXm
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral17
- Target
  Electron V3.1/Monaco/min/vs/editor/editor.main.css
- Size 112KB
- SHA256 764a3dde806a7414402e87ce4bf2da4f5bb6f36910d887d5c8ee985c1bdf92bd
- MD5 deffa85f9389710f5ed0c1b4bf432459
- SHA1 a3e05dd6fd435e746d21e624a0e00e6149c2b196
- SHA512 13de3b8695763ac2ffc62bb2d31d06153187c41ed30de2b791d499b4a9a53ff4576457ff2baad5131582fd308a5c47bc089db2ef562025fc80c59c4b6df389bd
- SSDEEP 1536:0cGIS2lRL4PfPuPjPAPGPoNh4wnlMQBmBkCsJsE0akxPZP/PGPCju7:QUq5BmBkCsJsE0akE
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral18
- Target
  Electron V3.1/Monaco/vs/loader.js
- Size 27KB
- SHA256 0512d9ed3e5bb3daef94aa5c16a6c3e2ee26ffed9de00d1434ffe46a027b16b9
- MD5 8a3086f6c6298f986bda09080dd003b1
- SHA1 8c7d41c586bfa015fb5cc50a2fdc547711b57c3c
- SHA512 9e586742f4e19938132e41145deec584a7b8c7e111b3c6e9254f8d11db632ebe4d66898458ed7bcfc0614d06e20eb33d5a6a8eb8b32d91110557255cf1dbf017
- SSDEEP 768:3J6C/c2x0cAu57XQxJRDRi+R/TvrCv3zM2GRl0VEj:Z6grH7qTXRvmDI
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

execution
behavioral19
- Target
  Electron V3.1/Monaco/ws2_32.dll
- Size 416KB
- SHA256 7e412388c871f5f1d1651da11689eb82a7e4c5785409ec2753cfc4be484d910e
- MD5 f1fafc04216614ec5c7b8c6a82394dfd
- SHA1 5b6966d9af7bcf687aab982c26efe1c2adfaff18
- SHA512 0828267f5036b105982b2fc351c1c40d06ae4853ace76f131dc44d8dec0f9281b4fecab52ce273e2d9de06b95b8ce47af093689b9f9304de3577d47a3853f599
- SSDEEP 6144:0LYcepnIinzqyUMCLJ16iYRrKWr3GIIGepi6/GDQez5NzLJpyM7BVl7+jBSEYdRU:5d+iiYxKdns6+Dl5NpdqmU
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral20
- Target
  Electron V3.1/Monaco/zlib1.dll
- Size 113KB
- SHA256 945e7f5d09938b7769a4e68f4ef01406e5af9f40db952cba05ddb3431dd1911b
- MD5 75365924730b0b2c1a6ee9028ef07685
- SHA1 a10687c37deb2ce5422140b541a64ac15534250f
- SHA512 c1e31c18903e657203ae847c9af601b1eb38efa95cb5fa7c1b75f84a2cba9023d08f1315c9bb2d59b53256dfdb3bac89930252138475491b21749471adc129a1
- SSDEEP 3072:wsuxy/bjdeT1dtDCV8SSsfj7cTpHTBfQjxcHE2Fl:wsZ/bRe5PDCV8SLfcFTBIjxyE2Fl
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral21