xworm | 49fa9931e1ee5c4be3d2b0afe2fcd7b62505e8b45a59f6a13c8b428048f0ee78

Sharing

Copy URL Twitter E-mail

General

Target
49fa9931e1ee5c4be3d2b0afe2fcd7b62505e8b45a59f6a13c8b428048f0ee78.bin
Size 91.0MB
Sample260803-bn16laac72
SHA256 49fa9931e1ee5c4be3d2b0afe2fcd7b62505e8b45a59f6a13c8b428048f0ee78
MD5 9b5d7faa0c033b993195220f953ca306
SHA1 9d405581ae17f4fbd539b94f32b46a9e54c2e5f1
SHA512 abeed798f2fe3ac556e72873b33f48dbf9023d7b4954bae6f95a33a0e408a715bdd962223759a64f08c7f756d436c408db53f784f08800227767205aea1d87fa
SSDEEP 1572864:usqbBXnuTEwkBPiGO5vYMXTWu/Bh4RH7ZyOnbYXQQLv75cknTu7+ux8vMz24+Vuo:u3VXu1kg5HXR+h95Ugmvm4T0+u6vMztA
TLSH
T1E02833C3856AA9FFAA59ED5215D04719B72105F841F29CEE492BBF2F881CC8071683F7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

xworm

Attributes

Install_directory
%ProgramData%
install_file
svchot.exe
pastebin_url
https://pastebin.com/raw/F3a1Ks5J
telegram
https://api.telegram.org/bot8687829374:AAFHxc6lyd8wg4Jb_H2JkpkhuS4F74TCAGw/sendMessage?chat_id=8464882121

Targets

- Target
  uhqclient/__pycache__/backend.cpython-314.pyc
- Size 217KB
- SHA256 74a1e7b7225cf342185fcfc9010811b28efff16977a95df5373f88d22d22c101
- MD5 8db6f4965c0525b5cde477bbefd90a3d
- SHA1 37a7a533407cbc98128ac9181103e6dde5ddfdb5
- SHA512 8bc561433b40aa08013b7a5afd3126d05f1aa2d90a9353343d99cc39083b1e3575eb1c17d0b09dfdf5c2bc26b8e05895c613ad1801c4951ebd9b25483fe802c4
- SSDEEP 1536:5t358y3U/b8dB83phSYJTp+iF/uwUlXqlR+c1fOkjgzQ4yG/v3mwYzJXEl7r4hzl:7OH1bxUSxjgzcvXEYzlwvmSHIjl
- TLSH
  T15C243BF9AE305527EEE5F03831E29AC1E7229185E604CB43D6688C76BDCB365ED5630C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  uhqclient/backend.py
- Size 133KB
- SHA256 df3f21ee7c6e87db4b194b7fbc3d2ac232d150add40d9996dbbb0ae6af5b8b01
- MD5 9a8cee61a3da944cf90990a9aa6e7a0d
- SHA1 0ac6d4af5e9ce0c40b5c6d95afa13dac66129d78
- SHA512 d1819933f6235c8bf6b18f9d3e040e871f3648ccb661f116f566efd89a9604575c40a2351c24e084955354045bf0639cb52bc6eb5f200ba656adfa2f89931baf
- SSDEEP 1536:ZF6BjXKtdHa5ZAI0h1O3U2FscftNcid2uOUUR+yWVHtY7IfBzdyp7saoQSoe6Txm:qIxmAqaNBuEpMUfwVwd6weJGxa5
- TLSH
  T17CD3B57598892813E393E15C5C529202B369B90375097C39BEEC57AC2FDD47BC2B1AEC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  uhqclient/cdx_bridge.py
- Size 5KB
- SHA256 e62f37a00d46555233debc2868091c51a6f248689f25ea869be1fab9f3850257
- MD5 84a01fa96e1807525bd7ef0f6e35ffbb
- SHA1 36e81d2816db0c081ca71303146ee4f1da56c22a
- SHA512 c690f358da76c55d8143e1aa2b68481a9f83980b353f763c72ee0d235d022de0c0634922bd145259cd93301ffd3cf4536d80a95200c939a6fd72ed1ff6ef8bd0
- SSDEEP 96:k4VrcGq2Gxae/RVKZpPQT2HDcGTiS8RpXl6Ds:k4VRlG8uRgHc2HDcGTiS8R/6Ds
- TLSH
  T123C15674E43728B2C383BA3DC8709291AE68971E2F4855DFB5DCE94C0F19A358715F25
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  uhqclient/main.js
- Size 12KB
- SHA256 8fd455d11fd5022c12eab7fe4a0f584046c50fb5fa2876c474c8237250d8d050
- MD5 6af9a1848dea00cdd4330c83c95840b7
- SHA1 07c02cad5061afa89f83984a833b6a1fbab14973
- SHA512 1dab7e1c17a464a6299812bd664052f7adf9783ca2fbb33f3cc84f783da07048d3ed5328e1cff4e3bf0354856dedf1d846cfe6a8be6dc2dc6e9d98713483ea64
- SSDEEP 192:qA0Mtr5iXNX/wbfRX6XXNXk0Q+R5YAVXhrMUHgahND+M0CqFc0qwUgA4hVFeVXOe:qZMXtIBVHjhRFgA43MfIK
- TLSH
  T1D242A79950FB623949B3B02DD61B951A630BA1233309ED70F68C53507F853BDA6B2BDC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  uhqclient/main.py
- Size 81KB
- SHA256 8eee4edfdf14f60b0113e76ff76ee474d535b4fc50290877cfa68cccdaa78a49
- MD5 b780891edd1d85e33147abeed4a4ab09
- SHA1 546dcc4d475ab7661c7de553c009917de3d86de6
- SHA512 b6cb5a1fed6160480899060ecdba68e7e340abe368f8acae8762ef377bef2a16a6584c102cc713d82d8f08cd94654eef7e369a3854a34bf02041c88fa292b5f8
- SSDEEP 1536:AsP5LL7ps4wrTU6F85oqgCD5BCHP3TkcRSNS4WGDYfeA/2:AsP5XNpwvTFEoqgC0R6DweA/2
- TLSH
  T1A78383114C25183A5E73D62D8CB28162F727630B0B3464A3FEEC96D01F7886ADF65DB9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  uhqclient/node_modules/.bin/electron
- Size 379B
- SHA256 3efcabbe6f1397be1ee69d8aa0c54b1b3df34b494e15b6dbb82306c4f96fa7db
- MD5 6ee06f5d0fa38ff3653e0d6c43b3d38f
- SHA1 2a193402d299b3894e3f555c795ecfa1e6811579
- SHA512 bcb88d4bf776685b0cb9a5a387086c134a27d4ee214ad805a08464f6b74723fbd6717539797c4636017d352b22fff3ee60276eb664fdd00cf38430d2b65d6c92
- TLSH
  T1A1E0D87124A16F72900D42F88D515C5C91AA1343B4043F95FD0C7B426B7131DB2EB72E
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery execution antivm
behavioral11 behavioral12 behavioral13 behavioral14
- Target
  uhqclient/node_modules/.bin/electron.cmd
- Size 320B
- SHA256 1f06764bf904f0b88060d6e0683cffee6e632689857de11ea9c0958b610adea9
- MD5 6b707144409b5a57d1949fa3823ccaad
- SHA1 3f1bca4c6c855402bd7d91ab75cff189881f24bd
- SHA512 7dfc6cb9c907a787d8a3015d9caf6359608d5a269c25ff9b97cf835607eb838605fa3c08adf8f983e182dad925066aa5b3e9f473a2ca9c7404767678fc817b25
- TLSH
  T1B2E07D76F0007441323B9B769447364236F2B748844701B6B83804FB6B413865BCF99D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  uhqclient/node_modules/.bin/electron.ps1
- Size 785B
- SHA256 5cba3f0db91463f725359e69ab2840964ef5f2c242d6fafe6f17a7aba36a2988
- MD5 d4b7de2cb73b989037053d20385dc418
- SHA1 5f3272bf469b2a88846b0e652f01068dd140fe2b
- SHA512 0fcb7cc8fb58609bc78b1bb5d7944e9521e7e1e9c1c9c0a2b990d4e518d4952d9f8ffc63f0e50bf3a9735698b43319364da34b834fdaf3e7cacd7c7cf5e38803
- TLSH
  T17801662478B03FA6C20E9A9717B51E00A296D66B14480F2AE4087F825B7162C23EF776
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral17 behavioral18 behavioral19 behavioral20
- Target
  uhqclient/node_modules/@sindresorhus/is/dist/index.js
- Size 20KB
- SHA256 1fb3f63c25756ba867857ed9f4b2ed515bcfc3ad4ac0eda8aaf1eba4798a93f6
- MD5 76953530f2fcdd3f35ad34b6a9dd5801
- SHA1 3ff872e4ea063770d3b8f6d787d97cd3a8a65036
- SHA512 2854f41c015bfaf659ef7ada5dbf0700b090ef9d7a745d3f2997d25a41dbfe637dc43f507c5954256d694e98555927d61d2fade35c9e94c0617b33529b5f73d3
- SSDEEP 192:w0OVDFVMxShJQ15/tIQQu+k45QdCJ1QSF76C/k+IkFwIdWksPQN4Ezk2NbqHNFjT:ihasc9LJ1IRqD8hrYgKnL
- TLSH
  T101923C68FC920895D90672383BBE41869D379946817416EDF57C4BC09F4EE2C83B2BED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  uhqclient/node_modules/@sindresorhus/is/dist/types.js
- Size 194B
- SHA256 e75c9cf08756be210c600a65162d6f37a404b936ab98830ef11e3b62d3842924
- MD5 2a54bec1e010cd4bd80809b834b6f650
- SHA1 296c779d6e25bb0049e6e58b16c07bc050e90a3a
- SHA512 27c9895c0e7df7055cfe031bd2dd22136469bc7a27bb9d4da8ff41d283974ec426ca3fff4c1588a7d3f332d41edc7c23cb62955a6a341adae810745f398fa479
- TLSH
  T18CC02282750BC6C10B6101CC852478C0E0A20032D05A14B6CFD98DBE8860A9E8045292
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  uhqclient/node_modules/@sindresorhus/is/dist/uhq.exe
- Size 88KB
- SHA256 bb28d2f6952b1c85344d53db2cd6937de7830541de7cde280006158a639da7b9
- MD5 a9fbf3ac95ce354c9be47885f8118685
- SHA1 82f112202c8fba4a45293f23945dcb6ffe14a61e
- SHA512 e1b444e05491cd3e5794a4b2702934cc525cbb859e7aeaa08f9aea5dfd6c396d23a86a50badf337799dfbfc816db410028e0d7c135bf58bb98186dcdb91b6eba
- SSDEEP 1536:XQk09c+xltx6gx4IEQz1XgSFShuVUSo3fobZCMqquJXbC8wod6/f+z9OS8xzTJbJ:A3nEQxg26UUScgbZ2g8BOvFtJ
- TLSH
  T197937C1837E90619F1FFAFB058E53257CB3AF6276503D51F2589028A1A23B84CE517FA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery execution xworm persistence rat trojan
- Detect Xworm Payload
- Family: Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral25 behavioral26
- Target
  uhqclient/node_modules/@sindresorhus/is/readme.md
- Size 16KB
- SHA256 65d18def65086d23fd0e03057cb42d7d025a25708563254342437c5427125ad2
- MD5 34311ea7a90117a94ae2bc1adfbf830a
- SHA1 0e324fbabf308d1416d48cd008c27ab3283cbfe9
- SHA512 7e6a5e906786cd4e9e1b417ae6008d7ada8f69b41e3b0313782c76ac5288b22fb48fb402e9fc8949d38ae85c98472dae5da4af7c52e02a8778f8ba95bc12358e
- SSDEEP 384:Xkw1ZF1gxTXLhGlzAD26xA7QXpNDe8Gpm56OO73kLy9:UwN1gxTXLhD26ZNi8GpmMrk29
- TLSH
  T1F172B51ABA0197B48B3301E6ADEB309CC7D6D2059E7718F885BC48F57213D18C2B798E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  uhqclient/node_modules/electron/cli.js
- Size 612B
- SHA256 193a59dc9f5842c9564c88cc00e50bcb83c9bd771d1c47e7c1f2180ae2238404
- MD5 f5b9956c1b50191dcef6085f0b96a4ab
- SHA1 2509b9ba0bd58c0e693f1dd3640f9b129c9e1c16
- SHA512 8c7c374c80962137acbcff1b1a0a4a5a80b3c36212158db2bfe5bb5a3b3bb16dde5eaebbf0de8b66f5411852f92316f9f1163ccc9aec1d1b6574134ec8f3c6c3
- TLSH
  T128F0497C69FA02B8667620F6512A87135A7B4200218CC5D095CCC340AFE05F10387FEF
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery execution antivm
behavioral29 behavioral30 behavioral31 behavioral32