General
-
Target
SоlаraV3.exe
-
Size
326KB
-
Sample
241111-zs6hwawfjl
-
MD5
940f68edc497b2364f7751a06e5005c3
-
SHA1
243867ca7db62c2523dc208056747803308367fd
-
SHA256
7836ed81b575e364b75dfaea40971da1de436cbd33364d149df3dbc7ce7b5e42
-
SHA512
c9ad27a4407afdfa3130ccdea30b739bfdfae14e04010b65cf0850b49045d1614eb1b9a47be111d1c1d67ff0f94020208369d28d1ed7e6f038a574a183103f40
-
SSDEEP
6144:SWUovnLzJmE8O2hWbocJIJytNrlrqowMCjNthw66kIOpWWv7MO/:SWUovH4E8fkLIJkqNIjqW6t
Static task
static1
Malware Config
Extracted
xworm
127.0.0.1:3566
college-quarter.gl.at.ply.gg:3566
-
Install_directory
%LocalAppData%
-
install_file
Bootstraper.exe
Targets
-
-
Target
SоlаraV3.exe
-
Size
326KB
-
MD5
940f68edc497b2364f7751a06e5005c3
-
SHA1
243867ca7db62c2523dc208056747803308367fd
-
SHA256
7836ed81b575e364b75dfaea40971da1de436cbd33364d149df3dbc7ce7b5e42
-
SHA512
c9ad27a4407afdfa3130ccdea30b739bfdfae14e04010b65cf0850b49045d1614eb1b9a47be111d1c1d67ff0f94020208369d28d1ed7e6f038a574a183103f40
-
SSDEEP
6144:SWUovnLzJmE8O2hWbocJIJytNrlrqowMCjNthw66kIOpWWv7MO/:SWUovH4E8fkLIJkqNIjqW6t
-
Detect Xworm Payload
-
Xworm family
-
Executes dropped EXE
-
Loads dropped DLL
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Blocklisted process makes network request
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-