Overview
overview
10Static
static
10FastColore...ox.dll
windows7-x64
1FastColore...ox.dll
windows10-2004-x64
1Fixer.bat
windows7-x64
1Fixer.bat
windows10-2004-x64
1GMap.NET.Core.dll
windows7-x64
1GMap.NET.Core.dll
windows10-2004-x64
1GMap.NET.W...ms.dll
windows7-x64
1GMap.NET.W...ms.dll
windows10-2004-x64
1Guna.UI2.dll
windows7-x64
1Guna.UI2.dll
windows10-2004-x64
1IconExtractor.dll
windows7-x64
1IconExtractor.dll
windows10-2004-x64
1Icons/Downloader.hta
windows7-x64
3Icons/Downloader.hta
windows10-2004-x64
3Icons/Outf...ut.exe
windows7-x64
10Icons/Outf...ut.exe
windows10-2004-x64
10Icons/Output.exe
windows7-x64
8Icons/Output.exe
windows10-2004-x64
8Icons/XClient.exe
windows7-x64
10Icons/XClient.exe
windows10-2004-x64
10Mono.Cecil.Mdb.dll
windows7-x64
1Mono.Cecil.Mdb.dll
windows10-2004-x64
1Mono.Cecil.Pdb.dll
windows7-x64
1Mono.Cecil.Pdb.dll
windows10-2004-x64
1Mono.Cecil.Rocks.dll
windows7-x64
1Mono.Cecil.Rocks.dll
windows10-2004-x64
1Mono.Cecil.dll
windows7-x64
1Mono.Cecil.dll
windows10-2004-x64
1MonoMod.Backports.dll
windows7-x64
1MonoMod.Backports.dll
windows10-2004-x64
1MonoMod.Core.dll
windows7-x64
1MonoMod.Core.dll
windows10-2004-x64
1General
-
Target
XWorm V5.2.zip
-
Size
50.1MB
-
Sample
240802-2vhkyatflm
-
MD5
9708d19fa9f583748f252f35606a84e8
-
SHA1
9817368991be44c479eef076338361455efb90f2
-
SHA256
6bde76de6064f5cb941da866a26b81f18d4a7e3d738d416238fa73c0b01149a7
-
SHA512
d7a829b3001e45ac69ff521d7c8a94739d520abaf46fd8b6426b58faed73f296310c8990c5bd0dd17b2efd55efd2698c37fe5b7fa169aa3378abb268ebc3170a
-
SSDEEP
1572864:v35cgiPnjmoHYeSF+v88It5VCpbmrfi37J:vJcpPS9208mHCIzirJ
Behavioral task
behavioral1
Sample
FastColoredTextBox.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
FastColoredTextBox.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
Fixer.bat
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
Fixer.bat
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
GMap.NET.Core.dll
Resource
win7-20240705-en
Behavioral task
behavioral6
Sample
GMap.NET.Core.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
GMap.NET.WindowsForms.dll
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
GMap.NET.WindowsForms.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
Guna.UI2.dll
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
Guna.UI2.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
IconExtractor.dll
Resource
win7-20240729-en
Behavioral task
behavioral12
Sample
IconExtractor.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
Icons/Downloader.hta
Resource
win7-20240704-en
Behavioral task
behavioral14
Sample
Icons/Downloader.hta
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
Icons/Outfuytftjgfuyjput.exe
Resource
win7-20240705-en
Behavioral task
behavioral16
Sample
Icons/Outfuytftjgfuyjput.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
Icons/Output.exe
Resource
win7-20240705-en
Behavioral task
behavioral18
Sample
Icons/Output.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
Icons/XClient.exe
Resource
win7-20240708-en
Behavioral task
behavioral20
Sample
Icons/XClient.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
Mono.Cecil.Mdb.dll
Resource
win7-20240729-en
Behavioral task
behavioral22
Sample
Mono.Cecil.Mdb.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
Mono.Cecil.Pdb.dll
Resource
win7-20240704-en
Behavioral task
behavioral24
Sample
Mono.Cecil.Pdb.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
Mono.Cecil.Rocks.dll
Resource
win7-20240704-en
Behavioral task
behavioral26
Sample
Mono.Cecil.Rocks.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
Mono.Cecil.dll
Resource
win7-20240708-en
Behavioral task
behavioral28
Sample
Mono.Cecil.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
MonoMod.Backports.dll
Resource
win7-20240708-en
Behavioral task
behavioral30
Sample
MonoMod.Backports.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
MonoMod.Core.dll
Resource
win7-20240708-en
Behavioral task
behavioral32
Sample
MonoMod.Core.dll
Resource
win10v2004-20240802-en
Malware Config
Extracted
xworm
31.167.24.129:7000
154.61.71.50:7000
2.90.87.156:7000
86.96.100.98:7000
-
Install_directory
%Temp%
-
install_file
USB.exe
Extracted
xworm
5.0
127.0.0.1:7000
JYj1EIwWwj45bGVr
-
Install_directory
%AppData%
-
install_file
XClient.exe
Targets
-
-
Target
FastColoredTextBox.dll
-
Size
333KB
-
MD5
b746707265772b362c0ba18d8d630061
-
SHA1
4b185e5f68c00bef441adb737d0955646d4e569a
-
SHA256
3701b19ccdac79b880b197756a972027e2ac609ebed36753bd989367ea4ef519
-
SHA512
fd67f6c55940509e8060da53693cb5fbac574eb1e79d5bd8f9bbd43edbd05f68d5f73994798a0eed676d3e583e1c6cde608b54c03604b3818520fa18ad19aec8
-
SSDEEP
6144:4FErOIif3RzSHh+20lXs1TzCeBcQeDbNlz7:eEeR52bmeh0n
Score1/10 -
-
-
Target
Fixer.bat
-
Size
122B
-
MD5
2dabc46ce85aaff29f22cd74ec074f86
-
SHA1
208ae3e48d67b94cc8be7bbfd9341d373fa8a730
-
SHA256
a11703fd47d16020fa099a95bb4e46247d32cf8821dc1826e77a971cdd3c4c55
-
SHA512
6a50b525bc5d8eb008b1b0d704f9942f72f1413e65751e3de83d2e16ef3cf02ef171b9da3fff0d2d92a81daac7f61b379fcf7a393f46e914435f6261965a53b3
Score1/10 -
-
-
Target
GMap.NET.Core.dll
-
Size
2.9MB
-
MD5
819352ea9e832d24fc4cebb2757a462b
-
SHA1
aba7e1b29bdcd0c5a307087b55c2ec0c7ca81f11
-
SHA256
58c755fcfc65cddea561023d736e8991f0ad69da5e1378dea59e98c5db901b86
-
SHA512
6a5b0e1553616ea29ec72c12072ae05bdd709468a173e8adbdfe391b072c001ecacb3dd879845f8d599c6152eca2530cdaa2c069b1f94294f778158eaaebe45a
-
SSDEEP
49152:ot12Gb/hz7ZsK9qY5uyUW57VC4IB1+fXhQ1hyCzMw/22fSg7gjxhUE/nbTC0xemh:oLbteKb57W1+PhQ1HM1gmJ/SZmh
Score1/10 -
-
-
Target
GMap.NET.WindowsForms.dll
-
Size
147KB
-
MD5
32a8742009ffdfd68b46fe8fd4794386
-
SHA1
de18190d77ae094b03d357abfa4a465058cd54e3
-
SHA256
741e1a8f05863856a25d101bd35bf97cba0b637f0c04ecb432c1d85a78ef1365
-
SHA512
22418d5e887a6022abe8a7cbb0b6917a7478d468d211eecd03a95b8fb6452fc59db5178573e25d5d449968ead26bb0b2bfbfada7043c9a7a1796baca5235a82b
-
SSDEEP
3072:k1GmgYqIY/0YSDBRGlDUqL63budipxj64m8HWYh3vHbFwMhLJSb+:lIO6rGloqL63qW62lJ
Score1/10 -
-
-
Target
Guna.UI2.dll
-
Size
1.9MB
-
MD5
bcc0fe2b28edd2da651388f84599059b
-
SHA1
44d7756708aafa08730ca9dbdc01091790940a4f
-
SHA256
c6264665a882e73eb2262a74fea2c29b1921a9af33180126325fb67a851310ef
-
SHA512
3bfc3d27c095dde988f779021d0479c8c1de80a404454813c6cae663e3fe63dc636bffa7de1094e18594c9d608fa7420a0651509544722f2a00288f0b7719cc8
-
SSDEEP
24576:FIVZLRYIVQd9INo3FDbWX7SsOobBTEAjg+m+ZFNwaxwGoHQ/jzK+:+oWodbi9XFEAjg+m+ZFKaxw
Score1/10 -
-
-
Target
IconExtractor.dll
-
Size
10KB
-
MD5
640d8ffa779c6dd5252a262e440c66c0
-
SHA1
3252d8a70a18d5d4e0cc84791d587dd12a394c2a
-
SHA256
440912d85d2f98bb4f508ab82847067c18e1e15be0d8ecdcff0cc19327527fc2
-
SHA512
e12084f87bd46010aded22be30e902c5269a6f6bc88286d3bef17c71d070b17beada0fe9e691a2b2f76202b5f9265329f6444575f89aff8551c486eafe4d5f32
-
SSDEEP
192:7f77J4cGYyfQknxLvIgyLY5xJeU5pPpZlEAs:HS2yINgyLYLJR5wl
Score1/10 -
-
-
Target
Icons/Downloader.hta
-
Size
840B
-
MD5
0b7535abedbcd1db6a4d10e5667067f6
-
SHA1
8f49407ea3c4ca67c4bf5b39cf6a5a68ac35d9b1
-
SHA256
7dbe98ba16af54594ab1072f84e52c8e5ee70bf26a9a57508b7a735fd838e1e0
-
SHA512
75d124f50aec7f06d42c810a92e368615f2c75daf083a1549c4d918300a75e406145b9c06aa715a8e4847fe54e4796e277adbc875356b59672df7b5fb13fb557
Score3/10 -
-
-
Target
Icons/Outfuytftjgfuyjput.exe
-
Size
21.5MB
-
MD5
d7cbf73d8ccaf24ab5eaf25a97486a03
-
SHA1
821e1e3b44d90e395af3c7aae74aed3517b0e87f
-
SHA256
0fa9e4ae4c37fc9a72623aad1e478f1e54870874c344a4ab4598094997d673b8
-
SHA512
ffeb06eb8f74b0d3cc000ae77eb865c312b6d6b06c70c411ab9bb369711287e56b77aa3955c365ce1c69157d58a8264354dd0d8cbc3a1cbcf3414791812576db
-
SSDEEP
393216:8Y1yxf0Yw7elEezMgx+FBbul2mj7CflSRbdlUfKKL21LxMH4pw75otCO+pK:8eCf09eXa8o+7C4NdUL21dC7dp
Score10/10-
Detect Xworm Payload
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
-
-
Target
Icons/Output.exe
-
Size
34KB
-
MD5
3ad97760cfbba5f9b8931c04480b3ddd
-
SHA1
93bb1458ccbc0e3f3d79a547aab36959a1f1b4cb
-
SHA256
c7506d0fff0efd64311fcfde1653e5362ff68a636420cbf2ebf80f1e065a5b3d
-
SHA512
b70c079b047452b930ba047b569811233e39f62eda3659fef8eb60626b9599a157a28871c107f92e4d3b03548c7b10478401b4f61f8ad5d88f13a3ee97e2c6de
-
SSDEEP
768:gXRRIGt7wawdaoNVLqhrBvQ0CYQLHCVfg:0RfJwdaoNVsdI0yLH
-
Download via BitsAdmin
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
-
-
Target
Icons/XClient.exe
-
Size
190KB
-
MD5
b2234a1b2a6b4b0e9bfbeeb540e86725
-
SHA1
d1e45aa8f1136a8809837ad72943dc7e580767e1
-
SHA256
d1ee800872c14d799d38ab0fb08b1d3c6573cef795f8c3eb9e3066e106e3dabb
-
SHA512
946eebfb60ea5081f59e9f31a56097564cc52e2b688b77d37eecbca3519e1122c872c98a129f27dc86a4032ef18ca4a98f1ddbdd283076e2e880d17bf63149f5
-
SSDEEP
3072:ghmiN/KabiG+6BO79ba3v7EsUT8rmtIhK:DiAabf8O/HUTftO
Score10/10-
Detect Xworm Payload
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
-
-
Target
Mono.Cecil.Mdb.dll
-
Size
42KB
-
MD5
1c6aca0f1b1fa1661fc1e43c79334f7c
-
SHA1
ec0f591a6d12e1ea7dc8714ec7e5ad7a04ef455d
-
SHA256
411f8ed8c49738fa38a56ed8f991d556227d13602e83186e66ae1c4f821c940b
-
SHA512
1c59e939d108f15881d29fe4ced4e5fa4a4476394b58b6eb464da77192cb8fe9221b7cd780af4596914d4cce7c3fc53f1bb567f944c58829de8efbe1fd87be76
-
SSDEEP
768:Ar5EYZep98C87KHeBUZwrEzsEAnbF+em50KktmM4CRIcZwMRTIzMAtpw:Ar59g98C87KHeBUb5AnZG+zdwMRTzAtS
Score1/10 -
-
-
Target
Mono.Cecil.Pdb.dll
-
Size
87KB
-
MD5
6d5eb860c2be5dbeb470e7d3f3e7dda4
-
SHA1
80c76660b87c52127b1a7da48e27700f75362041
-
SHA256
447ede1984bb4acd73bd97c0ec57a11c079cee8301c91fb199ca98c1906d3cc4
-
SHA512
64cf4fe7de68a35720d2b9338ba9cf182e127d95d72d2ccf7ff5c73a368133663e70c988a460825fa87b2d03717a4447948d5262f56aceb7c3bf1cb3ab5a41a5
-
SSDEEP
1536:2OCAsdBo+am5OMwr5IlALYKXgAJGsZhTjrjvjCXeO:ZCjta0OMuIlArVJGqT/jveXeO
Score1/10 -
-
-
Target
Mono.Cecil.Rocks.dll
-
Size
27KB
-
MD5
6e7f0f4fff6c49e3f66127c23b7f1a53
-
SHA1
14a529f8c7ee9f002d1e93dcf8ff158ab74c7e1a
-
SHA256
2e2623319bdc362974a78ea4a43f4893011ec257884d24267f4594142fcd436e
-
SHA512
0c773da6717dd6919cd6241d3cee26ab00bb61ea2dbeff24844a067af4c87ff5cbdb2fe3ada5db4707cee921b3fb353bd12ee22b8490597d4f67ad39bace235e
-
SSDEEP
384:70ve8JOuJ5iC7n2NwxEXCni+VXcMeDz8PmR1ugLoaeuLMBG9UphJAprjE3uFLHa9:7+m4iCyrXOhG8uRssveum1pMFLHFBvd
Score1/10 -
-
-
Target
Mono.Cecil.dll
-
Size
350KB
-
MD5
de69bb29d6a9dfb615a90df3580d63b1
-
SHA1
74446b4dcc146ce61e5216bf7efac186adf7849b
-
SHA256
f66f97866433e688acc3e4cd1e6ef14505f81df6b26dd6215e376767f6f954bc
-
SHA512
6e96a510966a4acbca900773d4409720b0771fede37f24431bf0d8b9c611eaa152ba05ee588bb17f796d7b8caaccc10534e7cc1c907c28ddfa54ac4ce3952015
-
SSDEEP
6144:jIevdbLPNYe8bikm98KXPHhOWY/fFREomhUFD3z:se1PNL+QRfBg/f/EWFD
Score1/10 -
-
-
Target
MonoMod.Backports.dll
-
Size
138KB
-
MD5
dd43356f07fc0ce082db4e2f102747a2
-
SHA1
aa0782732e2d60fa668b0aadbf3447ef70b6a619
-
SHA256
e375b83a3e242212a2ed9478e1f0b8383c1bf1fdfab5a1cf766df740b631afd6
-
SHA512
284d64b99931ed1f2e839a7b19ee8389eefaf6c72bac556468a01f3eb17000252613c01dbae88923e9a02f3c84bcab02296659648fad727123f63d0ac38d258e
-
SSDEEP
3072:kRu+JWxtm5UE1cy/4HJW/SwUif9T2FpsP3Y+RJgv:kRTJWfNE1CuSMlTIeTRm
Score1/10 -
-
-
Target
MonoMod.Core.dll
-
Size
216KB
-
MD5
b808181453b17f3fc1ab153bf11be197
-
SHA1
bce86080b7eb76783940d1ff277e2b46f231efe9
-
SHA256
da00cdfab411f8f535f17258981ec51d1af9b0bfcee3a360cbd0cb6f692dbcdd
-
SHA512
a2d941c6e69972f99707ade5c5325eb50b0ec4c5abf6a189eb11a46606fed8076be44c839d83cf310b67e66471e0ea3f6597857a8e2c7e2a7ad6de60c314f7d3
-
SSDEEP
6144:mV+Fj3NL3NdYIRTdJ3AdHwSOTboZK3MYt:hFj3NL3NdYIRTdJ3AdHp2
Score1/10 -
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
BITS Jobs
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1