General
-
Target
Xworm-V5.6.rar
-
Size
56.5MB
-
Sample
240905-1q8qws1ejb
-
MD5
c282d2fdbefeed0e7dca679619e33615
-
SHA1
1b43eb3caa31a43b6cb2f1c6d6b2edb5b6975b0f
-
SHA256
d1e4f63805d566fc0ec48d49f78bca96b59a8605ae634cc28470052137f98ff8
-
SHA512
c25eb2ad45ee8c91745401755325e6c3dd0e41a056792d3dd399f4b3454c8d933e2776aac1603cc275f763d426a17fc5062876ff7dccba51b8f1d202c0342c16
-
SSDEEP
1572864:jNBL/+thxfQiXStMyHp5A9aWSU359/Jd7/mFJVIWi1aO:j3/QBlXpRSUPf7AIWi1aO
Behavioral task
behavioral1
Sample
Xworm-V5.6/Xworm-V5.6/Xworm V5.6 Starter.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Xworm-V5.6/Xworm-V5.6/Xworm V5.6 Starter.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
Xworm-V5.6/Xworm-V5.6/Xworm V5.6.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
Xworm-V5.6/Xworm-V5.6/Xworm V5.6.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
xworm
manufacturer-rank.gl.at.ply.gg:60383
-
Install_directory
%AppData%
-
install_file
USB.exe
Targets
-
-
Target
Xworm-V5.6/Xworm-V5.6/Xworm V5.6 Starter.exe
-
Size
7.7MB
-
MD5
bbf43a166ade7e2a0d2b930c41fb20a3
-
SHA1
d956dd742690aa25a59a84104cd3adbc40fcba78
-
SHA256
e948b08eb91c2dca67517126d71e5175e222598e6f1928d3ee78560b08e40b2b
-
SHA512
fcad5fc89da1d823a929cfebcdd19869605d646696f2399b2a84caa78e5a9854622e9d6b4184aba4ae080650513e1db01eb2412d995f87f18c4da90293fe523b
-
SSDEEP
196608:zKLCFU/jHq/puROyhxeyOC7+oiRkbtejBe5x:zmq/pkOYxehohbtB
Score10/10-
Detect Xworm Payload
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
-
-
Target
Xworm-V5.6/Xworm-V5.6/Xworm V5.6.exe
-
Size
14.9MB
-
MD5
56ccb739926a725e78a7acf9af52c4bb
-
SHA1
5b01b90137871c3c8f0d04f510c4d56b23932cbc
-
SHA256
90f58865f265722ab007abb25074b3fc4916e927402552c6be17ef9afac96405
-
SHA512
2fee662bc4a1a36ce7328b23f991fa4a383b628839e403d6eb6a9533084b17699a6c939509867a86e803aafef2f9def98fa9305b576dad754aa7f599920c19a1
-
SSDEEP
196608:P4/BAe1d4ihvy85JhhYc3BSL1kehn4inje:PuyIhhkRka4i
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload
-
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1