General
-
Target
https://cdn.discordapp.com/attachments/1299033012801110140/1314795009614024765/All_function.rar?ex=675511c6&is=6753c046&hm=400f52e1453dc133d03dcade625b2e88e4d1249ce88ce060262ca7ad37ef9e69&
-
Sample
241207-jm3a9ssqhz
Malware Config
Extracted
xworm
45.141.27.248:7777
-
Install_directory
%AppData%
-
install_file
svchostt.exe
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Targets
-
-
Target
https://cdn.discordapp.com/attachments/1299033012801110140/1314795009614024765/All_function.rar?ex=675511c6&is=6753c046&hm=400f52e1453dc133d03dcade625b2e88e4d1249ce88ce060262ca7ad37ef9e69&
Score10/10-
Detect Xworm Payload
-
Xred
Xred is backdoor written in Delphi.
-
Xred family
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Suspicious Office macro
Office document equipped with macros.
-
Executes dropped EXE
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-