Overview

overview

10

Static

static

10

Xwrom/XWorm V5.6.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    XWorm.V5.6.zip

  • Size

    17.3MB

  • Sample

    240715-txazwasbpb

  • MD5

    f5afa2b8b3702b8a63cc8f3ef5347c92

  • SHA1

    a2d3c8e8c082e05157db8e32d55c58ab22adb503

  • SHA256

    8ba9b12031e5f17c36580506ed7ee0c396175a7f569dafe47b800fbb83624a61

  • SHA512

    c1b84587484f89e5183e5d97819a28568ecd47ae55fdbfd53cc9493379c0110a2a1bb06cb5cafc35f44842f71dc50b02831474aed9cbb06b4043791f9893c13a

  • SSDEEP

    393216:GyaLq4XFeuBc9Q+FW7GMm389HCjIR7kjJPGAKbtUb8qcz:Gy74XDBYQw6GP2kjNKtpz

Score
10/10
agentteslastormkittyxwormpersistence

Malware Config

Extracted

Family

xworm

C2

127.0.0.1:59769

usr-contemporary.gl.at.ply.gg:59769
Attributes
  • Install_directory

    %Userprofile%

Targets

    • Target

      Xwrom/XWorm V5.6.exe

    • Size

      476KB

    • MD5

      bf1ccd2d127e4ac0dc4ad6307cd1b62f

    • SHA1

      fc95eb4ec00d3b745fb97f7f8f140cfbe51c23ac

    • SHA256

      b32c1554a1a62e6d4c30bad330e5146016fe11521671536c669b429b895e5a11

    • SHA512

      0b6fcb5596904849c5d1ef7439af2849394a56a5f64d337b85cfe2158c8aff2c2a6db5a03c5464520537ec5a203f4c784db4e47d48dc16efdfe064a0e831a3ce

    • SSDEEP

      12288:nB3VqDKxV3hy1gtF06T4UD/Tdv0Vsc+F:niOVyv6rPd0y

    Score
    7/10
    persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks