Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
XClientpidaras.exe
-
Size
69KB
-
Sample
240929-w3ax6sydrd
-
MD5
a707d15921c6043a7fbb95dd94b0bd68
-
SHA1
0ba8feed0de0b26ecc7e86c8dc33a1e961176075
-
SHA256
8615911309f47f5540b2a3d340a12320dda86d2a029ed358315f3e3dac9fef08
-
SHA512
2aa2ff6a434e71553171e257d723ecb319c9fc74ab9a2684e40d2b448421587f45cb8607a8d38e6ce731b04f0bc93013ffadf4441ec9750ed9d48893c110d237
-
SSDEEP
1536:UTYFWL2D3I3Ev4rIRzGgbTR6gkq0hjk6fVMKlXOebtQV:gYf7QczHbTRNgjrMAOebmV
Behavioral task
behavioral1
Sample
XClientpidaras.exe
Resource
win7-20240903-en
Malware Config
Extracted
xworm
-
Install_directory
%Temp%
-
install_file
chyrka228.exe
-
pastebin_url
https://pastebin.com/raw/MdxXj6A4
Targets
-
-
Target
XClientpidaras.exe
-
Size
69KB
-
MD5
a707d15921c6043a7fbb95dd94b0bd68
-
SHA1
0ba8feed0de0b26ecc7e86c8dc33a1e961176075
-
SHA256
8615911309f47f5540b2a3d340a12320dda86d2a029ed358315f3e3dac9fef08
-
SHA512
2aa2ff6a434e71553171e257d723ecb319c9fc74ab9a2684e40d2b448421587f45cb8607a8d38e6ce731b04f0bc93013ffadf4441ec9750ed9d48893c110d237
-
SSDEEP
1536:UTYFWL2D3I3Ev4rIRzGgbTR6gkq0hjk6fVMKlXOebtQV:gYf7QczHbTRNgjrMAOebmV
-
Detect Xworm Payload
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-