General
-
Target
DeltaCrack (infected).zip
-
Size
44KB
-
Sample
250121-a42xdsxpdx
-
MD5
308c95817e5b1b3bfe4b73900588b8a8
-
SHA1
2fb5b810ec2752f02562643b786e27d03201707a
-
SHA256
3fb485dc0b2ea2a2fa5a43f84d87feb03e189951f9a1f87ff130ae114d73184c
-
SHA512
a80856fce526b9458b6350c1cdf599eadf968ca53e8432dab584035c355b34ce1f5dc9e299a69f760f54e4490f8e5000067f985ad9ab0c31bef143392cc27ca0
-
SSDEEP
768:slhTt/ZzjcEFvNNTWh8ZLemF/ej7Z5tRV0CNoR0wzQZFjSuAtDfGSj:qh/Vj+5auZ5p0C+R0gQHHA5Rj
Malware Config
Extracted
xworm
userxmorma-27072.portmap.host:27072
-
Install_directory
%ProgramData%
-
install_file
svchost.exe
Targets
-
-
Target
DeltaCrack.exe
-
Size
76KB
-
MD5
331b5c6dda37833f554e5e6c9d44e3f1
-
SHA1
fffef041a29de6e8074892d5ffdcc9fca9baf297
-
SHA256
cd9f53b64227c1bd9aac338ca4c2f52f62dfe709b5daa1ec2356ea423f7abcae
-
SHA512
5b1a5c7890d254c67daabbcc470bd816520f65fdaa11bf1f49756ca236685005cdb0c22454842f3610f80c0e1d566632be0a75bff8c54bb301524332bcfc136c
-
SSDEEP
1536:LuEnJn49wJcmzpafAuQRmYr+bSeRCNWXnn64TTEOm9i2W4YL:yEd0ucfAvwYr+btCwXFYOT2W7L
Score10/10-
Detect Xworm Payload
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Adds Run key to start application
-