xworm | 97a0016c1af967a1025eb278b9e26a650d30506dd898508d36b92f26e82b4b6a

Sharing

Copy URL Twitter E-mail

General

Target
Velocity.zip
Size 28.4MB
Sample260504-fs3mfacv6w
SHA256 97a0016c1af967a1025eb278b9e26a650d30506dd898508d36b92f26e82b4b6a
MD5 cc9ab7d5d424adbb738fb578f3af856d
SHA1 25ed202416a1ff935ae2abb9b5af982b71ec7f69
SHA512 3fce7d756ef7cb1ecfd9ec3878e203365f41ab1dfbe2d2ae4410ca871a770fea77d3c7868125b6e6fb31f68b727eb7dc50df12a2a9c639ee22456b06fdbe637c
SSDEEP 786432:d7VTScF3mu89631UKYVrQXRZp1+kUcypNc7igGHsWhfjuoPGoD2rb:d7jm/96lUKrhB+ZFpNc7GxhfzRD2rb
TLSH
T1746733CB59C204961A57F267C7DD2E9A141FA31436ABDF3AF3819F884F800E6C74D49A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Bin/VMProtectSDK64.dll
- Size 124KB
- SHA256 d43329ee5af52665bc4afc3f7dcbe1d8aa13528f49d7580df15a9c9ced50c0ca
- MD5 3339229041a6aaedfc037afefe58813f
- SHA1 1121e690c877b23a623f57b8d339b494c20b209f
- SHA512 bff891e88d6b956bd75fee560fb6c38577322c4a61a288f6ab7baa8e0906d2fdc5b00a936359fc98f0b060940c3418d74412d97d7ab8abdd11603b6328051821
- SSDEEP 3072:1mcqYHq7Aiytzg2ScpvgJcG5sqYX6UOHNlBS:g0Hq7AiyegZgJZSXmtH
- TLSH
  T1A1C37C5773E540BBD1B6CA79C8638A56D7B178110B24DBAF03A402162F233D18F3AF62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  Scripts/Favourites/Dark Dex,lua
- Size 769KB
- SHA256 514dfbb86b40ede6f3d0abd70b5d2935c807161d815138f23ecb0ffffe1eace1
- MD5 fd55d68a2c6b02eca802fd365359c1fc
- SHA1 6cfc853cecb82cc6458e7d9bf1e87336fdd637d6
- SHA512 41feb566b622b8eab94fa8ea53124359a12904f17cf70e240fd8f2dbca22ee9c3f219de22af573c36f1ca7962626819abbaacbb5a484c90ad50bc6d5ea744ee3
- SSDEEP 6144:8DS0p3l3XgRGS+J5sme4dGuRXPnJZXBoiZ0DbQwZNXsDSyGQE4SRJ48RgQxAaNS6:5VYTeCO
- TLSH
  T119F4830C22898EFE97636D64B0E3158DB2E86263D3D91540E1BD4E1CF24DE5B05B7A8F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral2
- Target
  Scripts/Fun Scripts/Infinite Yield FE.lua
- Size 472KB
- SHA256 1c071c31271791272a4d21bc2ca6b571b20020444a33883611c2b315247f8cb5
- MD5 aa40a2d10223dcc7eea00701a53cfae9
- SHA1 a5772eda1152fd8917c4de08814b7ac69b650c63
- SHA512 65f11aff17166f846ae0ec6e451cf4df0dbc3dbeb4da4a90e472e86db5c0769b0db9b05e1c75eb095c88201811a12e115b7ea5cae86187b69e3ce123c8435b72
- SSDEEP 6144:FGfBMi+jpIPxvuv6oZf8D3xzLdzFI8gOyT8NPle+niXX6rWagl8Wi7ZSnjPuO5HD:AojpIPxvqfyh1F9NniXDX+O
- TLSH
  T17CA4F79E319E16AD1A17A26DB46308463EBFE03510091A5DF8FC513C6BCD60F81F7AB9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  Scripts/Fun Scripts/Sirius.lua
- Size 182KB
- SHA256 52a0ca20e499400cd766bc9676ded35d0eb0a9bed6bb20bea5488f3054575fed
- MD5 b5704851fc56ef02c7450068c1c9bbc9
- SHA1 ba88206f41d9607057ef9bd3120e29972b5975bb
- SHA512 d3bc75dace3e36d61d1bd78a92bb31a6028e509326ca0c6d09dd0e1e2749e3cd5bf9e37e7cb49d68a21fa22200b3bb3d20f70c7cb57fd1e2015fc1ce5d948b4e
- SSDEEP 1536:SKsQCXCWXIaIi/f9YeUAaFEuDQTvbRVinAx+j:X9CXCwId7eUAaFEuDQTTKj
- TLSH
  T1A804C58C316E62FC44A3418EE56B0415BEACB220626D5045F9AFB4BDC8CCB4EC5D67F6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral4
- Target
  Velocity.exe
- Size 33.0MB
- SHA256 be8fd5daf40b87257c42f4712b8879c65833e34f0b872b17d603258261854352
- MD5 de7f14b7e94f49a12325ace54b3f811b
- SHA1 09d50ab1c8cff44f88b301430e3397d93a349c5e
- SHA512 77904e060358a0ee81b9593b0967df72ca2708c2d9a9663e0301fa438b2ab33309213717dafd81fd12c64804215c9b1f6189f6de42edcc9b3055d295a8eafc27
- SSDEEP 786432:u649elQ+knSh3QQu3V2Va0Pa+MXlupvkUcZLqBMPsjp:u6fuNnS9QQ7cXXlupDcZSqUp
- TLSH
  T13A7712C2BB7B9144D94690F094BF122F1ABC5AEF419F5A1A934CBCC1BB7E95482670C3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery execution xworm persistence rat trojan
- Detect Xworm Payload
- Family: Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral5
- Target
  VelocityAPI.dll
- Size 17KB
- SHA256 7f8b8d05d22c24e9444e8c5da63e5631c762971f4ba6e79ba823fe3880fa95df
- MD5 229bdd461d751c7b63e61c926f5ed6b7
- SHA1 d2569c72e9408de66c36780e5c48074dd605db3a
- SHA512 c416b319574fedc597bb34710b22348751c976606602453890718eef9effa99c8bfd845392c8ffa9dd6c954e778e5e6d5fb57752cf4dbd40821eec9dc49b015a
- SSDEEP 384:BVrr3r+K+ftBdZ0rCbv/YOJaPhLuo2O6xNEQEQrzdaRS:BVrr3r+K+fPh/Y2UyDVl
- TLSH
  T193721A0A7FE8C677E6EE0AB85871021043F3D7157823FF5D68C7A4992D63B4A4614B1B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  WebView2Loader.dll
- Size 118KB
- SHA256 44ab92c2246ebfb5f98aa5726626fb44beb61543f2ef1803338af9fd295e63f0
- MD5 7b0eeac10cafb4acda98ccaf2f4b8eb1
- SHA1 9af3bdf0f62f6e4b3a936afc9b77fa9ac5a088d9
- SHA512 466b751a90d3b63e6394b47d459da70ee20eb7d6d40c48153996297e460fbaa02f32cab10b737fefd03a2ea62bd273025fc2ccde850faf42c904044c7ea8dab7
- SSDEEP 3072:F6JOAfv0Zj/zjziMy/4rnF4+jqb22EA2TNTEtJAfiPjezIgUW1:F6JNf89Q/In+qPEtJ/QNh
- TLSH
  T1FAC37B5075D080B1E5BE18390878EAB69B7F7990DF609DDB27841AA94F343D09F31B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7
- Target
  runtimes/win-x86/native/WebView2Loader.dll
- Size 118KB
- SHA256 44ab92c2246ebfb5f98aa5726626fb44beb61543f2ef1803338af9fd295e63f0
- MD5 7b0eeac10cafb4acda98ccaf2f4b8eb1
- SHA1 9af3bdf0f62f6e4b3a936afc9b77fa9ac5a088d9
- SHA512 466b751a90d3b63e6394b47d459da70ee20eb7d6d40c48153996297e460fbaa02f32cab10b737fefd03a2ea62bd273025fc2ccde850faf42c904044c7ea8dab7
- SSDEEP 3072:F6JOAfv0Zj/zjziMy/4rnF4+jqb22EA2TNTEtJAfiPjezIgUW1:F6JNf89Q/In+qPEtJ/QNh
- TLSH
  T1FAC37B5075D080B1E5BE18390878EAB69B7F7990DF609DDB27841AA94F343D09F31B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral8