Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    XClient.exe

  • Size

    169KB

  • Sample

    240625-pmgbpasfml

  • MD5

    5295e6e63d9ba5e51d537df2ef93a95c

  • SHA1

    8412fae03a631b2efe6cd477932872d3c75eedab

  • SHA256

    56d6e266596ba01b68c7545918cc666a2e23b5bb6878da70334b38c5cb1981fd

  • SHA512

    6175683a1c192a851b11901e3638c824fd81f7248c2901fa2cf703b1267645a6e40fdaf111ba15656ee25aba7e3ac29b34590ddb2a49356c973e2814137d2c0a

  • SSDEEP

    1536:qvDX04YtQQanlgpiUFoKkb1XMn6mVzpasWI46UZVtfvTOSRRRJxEq:qX0xYaoKkb1XHqwsW7ZVRbOSRzJxEq

Malware Config

Extracted

Family

xworm

C2

127.0.0.1:42975

20.ip.gl.ply.gg:42975

Attributes
  • Install_directory

    %AppData%

  • install_file

    svchost.exe

Targets

    • Target

      XClient.exe

    • Size

      169KB

    • MD5

      5295e6e63d9ba5e51d537df2ef93a95c

    • SHA1

      8412fae03a631b2efe6cd477932872d3c75eedab

    • SHA256

      56d6e266596ba01b68c7545918cc666a2e23b5bb6878da70334b38c5cb1981fd

    • SHA512

      6175683a1c192a851b11901e3638c824fd81f7248c2901fa2cf703b1267645a6e40fdaf111ba15656ee25aba7e3ac29b34590ddb2a49356c973e2814137d2c0a

    • SSDEEP

      1536:qvDX04YtQQanlgpiUFoKkb1XMn6mVzpasWI46UZVtfvTOSRRRJxEq:qX0xYaoKkb1XHqwsW7ZVRbOSRzJxEq

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks