General
-
Target
AstroBootStrapper_upd.exe
-
Size
35.3MB
-
Sample
240727-bzfzssycmj
-
MD5
6366596bda3516a281a91c2c10217f5f
-
SHA1
2029a7837a7aecc36e453ac7accaaf60be851a0e
-
SHA256
a02eef7ae229cfab507ec2a39994995ea8d905b6ded899b86aa2b64f50046b79
-
SHA512
e98f7e718fd97e1affa6cd591bb272bad0fea77d08a014d4075cfa0e82c0b270dea242e47541e37864518fa0dc356c16eb95b39c72a7c49513028db822e8cb8f
-
SSDEEP
786432:NUufa9gYBzTKPkwETf5bPBnB7294tGiNFeGl9jPlyTiS2j+S0mLzSqvZD:bfayKUuTfFPK94GiuGrjPloijT0O2qvp
Static task
static1
Behavioral task
behavioral1
Sample
AstroBootStrapper_upd.exe
Resource
win10v2004-20240709-en
Malware Config
Extracted
xworm
5.0
147.185.221.21:37029
ImJIbbArI7SKOVwD
-
Install_directory
%AppData%
-
install_file
ctfmon.exe
Targets
-
-
Target
AstroBootStrapper_upd.exe
-
Size
35.3MB
-
MD5
6366596bda3516a281a91c2c10217f5f
-
SHA1
2029a7837a7aecc36e453ac7accaaf60be851a0e
-
SHA256
a02eef7ae229cfab507ec2a39994995ea8d905b6ded899b86aa2b64f50046b79
-
SHA512
e98f7e718fd97e1affa6cd591bb272bad0fea77d08a014d4075cfa0e82c0b270dea242e47541e37864518fa0dc356c16eb95b39c72a7c49513028db822e8cb8f
-
SSDEEP
786432:NUufa9gYBzTKPkwETf5bPBnB7294tGiNFeGl9jPlyTiS2j+S0mLzSqvZD:bfayKUuTfFPK94GiuGrjPloijT0O2qvp
Score10/10-
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Detect Xworm Payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Sets desktop wallpaper using registry
-
Suspicious use of SetThreadContext
-