General
-
Target
Leakspiz.scr
-
Size
233KB
-
Sample
250119-pq4ldsxmdw
-
MD5
f58aec6120b249aac63c206f70e360e8
-
SHA1
ca8e94dcae8c43695707abf9f131432e85f5316c
-
SHA256
e5aea4ded0081eb59c809ee0542697ceda86a762e26371b82c3213035caab323
-
SHA512
c1b729cee3fdd5712f277baf6ce3d9f485fe07d5ec1c9555c054508d01061fe9ae8fe0bfa81b5e7fc85fd718d4ecbb19e7f37f9f16bc19ea2fd7658fb6e27d8a
-
SSDEEP
6144:SuCFpGbqzOzUhcX7elbKTua9bfF/H9d9n:FCjDyz3X3u+
Malware Config
Extracted
xworm
poker-dosage.gl.at.ply.gg:7000
-
Install_directory
%AppData%
-
install_file
RealtekUService86.exe
Targets
-
-
Target
Leakspiz.scr
-
Size
233KB
-
MD5
f58aec6120b249aac63c206f70e360e8
-
SHA1
ca8e94dcae8c43695707abf9f131432e85f5316c
-
SHA256
e5aea4ded0081eb59c809ee0542697ceda86a762e26371b82c3213035caab323
-
SHA512
c1b729cee3fdd5712f277baf6ce3d9f485fe07d5ec1c9555c054508d01061fe9ae8fe0bfa81b5e7fc85fd718d4ecbb19e7f37f9f16bc19ea2fd7658fb6e27d8a
-
SSDEEP
6144:SuCFpGbqzOzUhcX7elbKTua9bfF/H9d9n:FCjDyz3X3u+
-
Detect Xworm Payload
-
Xworm family
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-