General
-
Target
Vortex Grabber - Hotfix.rar
-
Size
13.6MB
-
Sample
240923-fb83wswfqr
-
MD5
d88da1f088042083a217ba352f625bd3
-
SHA1
9a18165ed680dd13d038a9413616a1744f597fd7
-
SHA256
ab2dab1968ab08e5bb5091376450b1de5fc87cc866faeecc42e1ec641fe83173
-
SHA512
36db2a136ac8a77970e2ac14f4132deb759df77444fb7596d225ec32ee6d598caa722909bb12ab7162c9cb4e08d8914088476276a0edd9d561f71e0286f8c009
-
SSDEEP
393216:oqCOgcXi0U1rrybYobKVAbEqS4CaF8YBn2b7/jQw/u:oqc79mqV/q268YBnI0ku
Behavioral task
behavioral1
Sample
Vortex Grabber - Hotfix/Vortex Grabber/Vortex.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Vortex Grabber - Hotfix/Vortex Grabber/Vortex.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
xworm
allow-failing.gl.at.ply.gg:45394
-
Install_directory
%Temp%
-
install_file
USB.exe
Targets
-
-
Target
Vortex Grabber - Hotfix/Vortex Grabber/Vortex.exe
-
Size
2.0MB
-
MD5
25f4b025e45207453ba4be4aca68c3a8
-
SHA1
aa211e18baa2b0ce8d326dc9bc5c45683a7fc1f9
-
SHA256
a1075248892016fdc7f305678e3c726cee7593360f0ac8ac283a9667c81df008
-
SHA512
3924db4f4583dcbd89d040bcc8dcd8f6599ba02a7aa9047c641ec92d7018bf1700d65c8cde844ca17e963c97038e14cc8927fb38de96f74f2a64bbcfd560d036
-
SSDEEP
24576:+vBjZKsjbfK3vhwTgpICiujOWJ8N73Y9CedEFGWEQOPfXUjOGjKoDBm5CXz1PQaZ:m1hby3vBbjO4N9H4OKDBeQZ2GP5ty3
Score10/10-
Detect Xworm Payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1