General
-
Target
62ba4ec06510e37fb216b054b958f8d205e78e81963856e86aa05815d8bb46c9N.exe
-
Size
34KB
-
Sample
241111-st4mca1bpm
-
MD5
9f2ca5e78023d1e89d1b72d5c5072a5e
-
SHA1
8d5cba96c8abb5159da6578fb31d82f299e91325
-
SHA256
b21c789dbe0699a1ea6c1ccfac5d2dee5eb9f47ec2f219fc15e5f6e7df3027c3
-
SHA512
9b4f77f48a388f4197a633f4f7102cb1c69166658fb29c45ad34101917963cc5f32b0cee22651de3f666762ce9ac91557010888151cbe772b5302ee3c03092f6
-
SSDEEP
768:AYBpz/QvWZqvoXu24OFrCxxF39XTp6LOjh/bUP:AYBpz/QvwtbFGrF39XV6LOjN4P
Behavioral task
behavioral1
Sample
62ba4ec06510e37fb216b054b958f8d205e78e81963856e86aa05815d8bb46c9N.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
62ba4ec06510e37fb216b054b958f8d205e78e81963856e86aa05815d8bb46c9N.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
xworm
5.0
127.0.0.1:26848
on-modules.gl.at.ply.gg:26848
wrmsNSNXixl9dMEG
-
Install_directory
%AppData%
-
install_file
USB.exe
Targets
-
-
Target
62ba4ec06510e37fb216b054b958f8d205e78e81963856e86aa05815d8bb46c9N.exe
-
Size
34KB
-
MD5
9f2ca5e78023d1e89d1b72d5c5072a5e
-
SHA1
8d5cba96c8abb5159da6578fb31d82f299e91325
-
SHA256
b21c789dbe0699a1ea6c1ccfac5d2dee5eb9f47ec2f219fc15e5f6e7df3027c3
-
SHA512
9b4f77f48a388f4197a633f4f7102cb1c69166658fb29c45ad34101917963cc5f32b0cee22651de3f666762ce9ac91557010888151cbe772b5302ee3c03092f6
-
SSDEEP
768:AYBpz/QvWZqvoXu24OFrCxxF39XTp6LOjh/bUP:AYBpz/QvwtbFGrF39XV6LOjN4P
Score10/10-
Detect Xworm Payload
-
Xworm family
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-