xworm

Sharing

Copy URL

Twitter E-mail

General

Target

Wave.exe
Size

7.3MB
Sample

240701-bcyaka1dre
MD5

92d883d4d144e110b1997924c390e11e
SHA1

c42ab515f865b429016fc16faecf0415d5004e29
SHA256

1297e636f5bcea89e6fc45a6dd05d0464451cc1dca7b423fd652e932dc6408e4
SHA512

c73352005a8034e9f0d044ebb7c9e4a0f97bee99fa0e9c6503ca70743232e1998b52846a0761c6fdab58c29554666e7122660b9da829210f3bb83f32f04981d9
SSDEEP

196608:V4FB96c/z3etLp+v2gwdP2gzmEWSyRy/16aGb3:VM8k3e1xdFqCm2a3

Score

10^/10

Malware Config

Extracted

Family

xworm

courses-disney.gl.at.ply.gg:21335

127.0.0.1:21335

Attributes

Install_directory
%AppData%
install_file
svchost.exe
telegram
https://api.telegram.org/bot7006468177:AAEjUyc53owWdXWMasYo_ZE1Y7t2sH1O718/sendMessage?chat_id=809478226

Targets

- Target
  
  Wave.exe
- Size
  
  7.3MB
- MD5
  
  92d883d4d144e110b1997924c390e11e
- SHA1
  
  c42ab515f865b429016fc16faecf0415d5004e29
- SHA256
  
  1297e636f5bcea89e6fc45a6dd05d0464451cc1dca7b423fd652e932dc6408e4
- SHA512
  
  c73352005a8034e9f0d044ebb7c9e4a0f97bee99fa0e9c6503ca70743232e1998b52846a0761c6fdab58c29554666e7122660b9da829210f3bb83f32f04981d9
- SSDEEP
  
  196608:V4FB96c/z3etLp+v2gwdP2gzmEWSyRy/16aGb3:VM8k3e1xdFqCm2a3
Score

10^/10

xworm discovery execution persistence rat spyware stealer trojan
- Detect Xworm Payload
- Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
behavioral1