Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
XClient.exe
-
Size
169KB
-
Sample
240625-pmgbpasfml
-
MD5
5295e6e63d9ba5e51d537df2ef93a95c
-
SHA1
8412fae03a631b2efe6cd477932872d3c75eedab
-
SHA256
56d6e266596ba01b68c7545918cc666a2e23b5bb6878da70334b38c5cb1981fd
-
SHA512
6175683a1c192a851b11901e3638c824fd81f7248c2901fa2cf703b1267645a6e40fdaf111ba15656ee25aba7e3ac29b34590ddb2a49356c973e2814137d2c0a
-
SSDEEP
1536:qvDX04YtQQanlgpiUFoKkb1XMn6mVzpasWI46UZVtfvTOSRRRJxEq:qX0xYaoKkb1XHqwsW7ZVRbOSRzJxEq
Behavioral task
behavioral1
Sample
XClient.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
XClient.exe
Resource
win10v2004-20240508-en
Malware Config
Extracted
xworm
127.0.0.1:42975
20.ip.gl.ply.gg:42975
-
Install_directory
%AppData%
-
install_file
svchost.exe
Targets
-
-
Target
XClient.exe
-
Size
169KB
-
MD5
5295e6e63d9ba5e51d537df2ef93a95c
-
SHA1
8412fae03a631b2efe6cd477932872d3c75eedab
-
SHA256
56d6e266596ba01b68c7545918cc666a2e23b5bb6878da70334b38c5cb1981fd
-
SHA512
6175683a1c192a851b11901e3638c824fd81f7248c2901fa2cf703b1267645a6e40fdaf111ba15656ee25aba7e3ac29b34590ddb2a49356c973e2814137d2c0a
-
SSDEEP
1536:qvDX04YtQQanlgpiUFoKkb1XMn6mVzpasWI46UZVtfvTOSRRRJxEq:qX0xYaoKkb1XHqwsW7ZVRbOSRzJxEq
Score10/10-
Detect Xworm Payload
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Adds Run key to start application
-