General
-
Target
XWorm V5.2.zip
-
Size
36.0MB
-
Sample
240722-r6fklsterm
-
MD5
d6757d3dbf1a98508f5cc3715df07e64
-
SHA1
bb5d6cb95edf409792cb59e99faa8d977d6404ec
-
SHA256
bbd19b42209127ad2b015d76f6fc37e35f2c4d751b1b4847a92fd218dd0caf1c
-
SHA512
34b9ebb5ca64824419c10d30727fac4660160e55cd793bf66470310ec6d2c4e74c3375f54da062032fa2ca3a38866d6a9f212f4b0911733dda56cd2ca012b5d6
-
SSDEEP
786432:JpMDUYoUO13WMuw2yCqwU0dDL5i4jYC7bsTsVsjGkkFsi5m557vHWa2gPBri:zfYLO1x2Cwhdf0ffTLjrpIot2a7W
Static task
static1
Behavioral task
behavioral1
Sample
XWorm V5.2.zip
Resource
win11-20240709-en
Malware Config
Targets
-
-
Target
XWorm V5.2.zip
-
Size
36.0MB
-
MD5
d6757d3dbf1a98508f5cc3715df07e64
-
SHA1
bb5d6cb95edf409792cb59e99faa8d977d6404ec
-
SHA256
bbd19b42209127ad2b015d76f6fc37e35f2c4d751b1b4847a92fd218dd0caf1c
-
SHA512
34b9ebb5ca64824419c10d30727fac4660160e55cd793bf66470310ec6d2c4e74c3375f54da062032fa2ca3a38866d6a9f212f4b0911733dda56cd2ca012b5d6
-
SSDEEP
786432:JpMDUYoUO13WMuw2yCqwU0dDL5i4jYC7bsTsVsjGkkFsi5m557vHWa2gPBri:zfYLO1x2Cwhdf0ffTLjrpIot2a7W
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE
-
Loads dropped DLL
-
Obfuscated with Agile.Net obfuscator
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Legitimate hosting services abused for malware hosting/C2
-
Drops file in System32 directory
-