General

  • Target

    Xworm-V5.6.rar

  • Size

    56.5MB

  • Sample

    240905-1q8qws1ejb

  • MD5

    c282d2fdbefeed0e7dca679619e33615

  • SHA1

    1b43eb3caa31a43b6cb2f1c6d6b2edb5b6975b0f

  • SHA256

    d1e4f63805d566fc0ec48d49f78bca96b59a8605ae634cc28470052137f98ff8

  • SHA512

    c25eb2ad45ee8c91745401755325e6c3dd0e41a056792d3dd399f4b3454c8d933e2776aac1603cc275f763d426a17fc5062876ff7dccba51b8f1d202c0342c16

  • SSDEEP

    1572864:jNBL/+thxfQiXStMyHp5A9aWSU359/Jd7/mFJVIWi1aO:j3/QBlXpRSUPf7AIWi1aO

Malware Config

Extracted

Family

xworm

C2

manufacturer-rank.gl.at.ply.gg:60383

Attributes
  • Install_directory

    %AppData%

  • install_file

    USB.exe

Targets

    • Target

      Xworm-V5.6/Xworm-V5.6/Xworm V5.6 Starter.exe

    • Size

      7.7MB

    • MD5

      bbf43a166ade7e2a0d2b930c41fb20a3

    • SHA1

      d956dd742690aa25a59a84104cd3adbc40fcba78

    • SHA256

      e948b08eb91c2dca67517126d71e5175e222598e6f1928d3ee78560b08e40b2b

    • SHA512

      fcad5fc89da1d823a929cfebcdd19869605d646696f2399b2a84caa78e5a9854622e9d6b4184aba4ae080650513e1db01eb2412d995f87f18c4da90293fe523b

    • SSDEEP

      196608:zKLCFU/jHq/puROyhxeyOC7+oiRkbtejBe5x:zmq/pkOYxehohbtB

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Target

      Xworm-V5.6/Xworm-V5.6/Xworm V5.6.exe

    • Size

      14.9MB

    • MD5

      56ccb739926a725e78a7acf9af52c4bb

    • SHA1

      5b01b90137871c3c8f0d04f510c4d56b23932cbc

    • SHA256

      90f58865f265722ab007abb25074b3fc4916e927402552c6be17ef9afac96405

    • SHA512

      2fee662bc4a1a36ce7328b23f991fa4a383b628839e403d6eb6a9533084b17699a6c939509867a86e803aafef2f9def98fa9305b576dad754aa7f599920c19a1

    • SSDEEP

      196608:P4/BAe1d4ihvy85JhhYc3BSL1kehn4inje:PuyIhhkRka4i

MITRE ATT&CK Enterprise v15

Tasks