General
-
Target
XWorm-5.6-main.zip
-
Size
25.1MB
-
Sample
241124-tqc6natncm
-
MD5
95c1c4a3673071e05814af8b2a138be4
-
SHA1
4c08b79195e0ff13b63cfb0e815a09dc426ac340
-
SHA256
7c270da2506ba3354531e0934096315422ee719ad9ea16cb1ee86a7004a9ce27
-
SHA512
339a47ecfc6d403beb55d51128164a520c4bea63733be3cfd47aec47953fbf2792aa4e150f4122994a7620122b0e0fc20c1eeb2f9697cf5578df08426820fecd
-
SSDEEP
786432:Ty5jMDNnx2+4NYobtH8VVtKqi9+i514XZ/pjYlp0:MMDNnxV4iobxibiIi5MpjYv0
Malware Config
Extracted
lumma
https://pillowbrocccolipe.shop/api
https://communicationgenerwo.shop/api
https://diskretainvigorousiw.shop/api
https://affordcharmcropwo.shop/api
https://dismissalcylinderhostw.shop/api
https://enthusiasimtitleow.shop/api
https://worryfillvolcawoi.shop/api
https://cleartotalfisherwo.shop/api
Extracted
xworm
5.0
127.0.0.1:7000
GVVMhs9us05bGRo4
-
install_file
USB.exe
Targets
-
-
Target
XWorm-5.6-main.zip
-
Size
25.1MB
-
MD5
95c1c4a3673071e05814af8b2a138be4
-
SHA1
4c08b79195e0ff13b63cfb0e815a09dc426ac340
-
SHA256
7c270da2506ba3354531e0934096315422ee719ad9ea16cb1ee86a7004a9ce27
-
SHA512
339a47ecfc6d403beb55d51128164a520c4bea63733be3cfd47aec47953fbf2792aa4e150f4122994a7620122b0e0fc20c1eeb2f9697cf5578df08426820fecd
-
SSDEEP
786432:Ty5jMDNnx2+4NYobtH8VVtKqi9+i514XZ/pjYlp0:MMDNnxV4iobxibiIi5MpjYv0
-
Detect Xworm Payload
-
Lumma family
-
Xworm family
-
Executes dropped EXE
-
Uses the VBS compiler for execution
-