General

  • Target

    Leaks‮piz.scr

  • Size

    233KB

  • Sample

    250119-pq4ldsxmdw

  • MD5

    f58aec6120b249aac63c206f70e360e8

  • SHA1

    ca8e94dcae8c43695707abf9f131432e85f5316c

  • SHA256

    e5aea4ded0081eb59c809ee0542697ceda86a762e26371b82c3213035caab323

  • SHA512

    c1b729cee3fdd5712f277baf6ce3d9f485fe07d5ec1c9555c054508d01061fe9ae8fe0bfa81b5e7fc85fd718d4ecbb19e7f37f9f16bc19ea2fd7658fb6e27d8a

  • SSDEEP

    6144:SuCFpGbqzOzUhcX7elbKTua9bfF/H9d9n:FCjDyz3X3u+

Score
10/10

Malware Config

Extracted

Family

xworm

C2

poker-dosage.gl.at.ply.gg:7000

Attributes
  • Install_directory

    %AppData%

  • install_file

    RealtekUService86.exe

Targets

    • Target

      Leaks‮piz.scr

    • Size

      233KB

    • MD5

      f58aec6120b249aac63c206f70e360e8

    • SHA1

      ca8e94dcae8c43695707abf9f131432e85f5316c

    • SHA256

      e5aea4ded0081eb59c809ee0542697ceda86a762e26371b82c3213035caab323

    • SHA512

      c1b729cee3fdd5712f277baf6ce3d9f485fe07d5ec1c9555c054508d01061fe9ae8fe0bfa81b5e7fc85fd718d4ecbb19e7f37f9f16bc19ea2fd7658fb6e27d8a

    • SSDEEP

      6144:SuCFpGbqzOzUhcX7elbKTua9bfF/H9d9n:FCjDyz3X3u+

    Score
    10/10
    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

    • Xworm family

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

MITRE ATT&CK Enterprise v15

Tasks