Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
armdot deobfuscator.exe
-
Size
275KB
-
Sample
240909-x89t5axhkh
-
MD5
2bce10bc9bf1c5e013965c7a60deae05
-
SHA1
7efa1765b1842f4ce9e746c26c7d8394ad7820ce
-
SHA256
5e74f08923fec3a5daf99b9a6c0763b21a98226f90c537235408a4258389ca01
-
SHA512
fbfadeb3f983cc76478864de82952ce34cb7543743a3421151827c5a8226d24ddff2409f71230dfc4bbfad441cea9a148a11a31c16e3890cd5a0797fe4a9e7c0
-
SSDEEP
6144:IwDHUsnM9rwQCz8vRtKT2OyD0Ek+c9NWtO5MxRxLJcNfZ:IAjMnZtgbyD0wyWtOcJeZ
Static task
static1
Malware Config
Extracted
xworm
5.0
127.0.0.1:41594
internal-bachelor.gl.at.ply.gg:41594
JgIYtyxyvTKZt7Bf
-
Install_directory
%LocalAppData%
-
install_file
svchost.exe
Targets
-
-
Target
armdot deobfuscator.exe
-
Size
275KB
-
MD5
2bce10bc9bf1c5e013965c7a60deae05
-
SHA1
7efa1765b1842f4ce9e746c26c7d8394ad7820ce
-
SHA256
5e74f08923fec3a5daf99b9a6c0763b21a98226f90c537235408a4258389ca01
-
SHA512
fbfadeb3f983cc76478864de82952ce34cb7543743a3421151827c5a8226d24ddff2409f71230dfc4bbfad441cea9a148a11a31c16e3890cd5a0797fe4a9e7c0
-
SSDEEP
6144:IwDHUsnM9rwQCz8vRtKT2OyD0Ek+c9NWtO5MxRxLJcNfZ:IAjMnZtgbyD0wyWtOcJeZ
-
Detect Xworm Payload
-
Blocklisted process makes network request
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-