General
-
Target
f7a2183a529d01b8ddc02990103866057d1084444968e93862bf1f83d2467947.exe
-
Size
72KB
-
Sample
240701-rv9z3swgrf
-
MD5
1b5b62e15509efce8bb5379b28a5210b
-
SHA1
e647ff934fc92b65344cb115b35c32e3792d36cc
-
SHA256
f7a2183a529d01b8ddc02990103866057d1084444968e93862bf1f83d2467947
-
SHA512
1d2f5872bea5c9742be431b7c6fdb78bb5b34e37dadf75ae764296681f568a465bb321588b445ff7657db40d1c883512814b6a1ead342624e0b34faaa2a16c60
-
SSDEEP
1536:VxEuAytfJGZfzoGwPZ3kbyZ0nbo2CESOOXEnqjQc8:VDCzLwPZ3kbyUZSOOXDt8
Behavioral task
behavioral1
Sample
f7a2183a529d01b8ddc02990103866057d1084444968e93862bf1f83d2467947.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f7a2183a529d01b8ddc02990103866057d1084444968e93862bf1f83d2467947.exe
Resource
win10v2004-20240508-en
Malware Config
Extracted
xworm
price-slow.gl.at.ply.gg:28067
-
Install_directory
%AppData%
-
install_file
XClient.exe
Targets
-
-
Target
f7a2183a529d01b8ddc02990103866057d1084444968e93862bf1f83d2467947.exe
-
Size
72KB
-
MD5
1b5b62e15509efce8bb5379b28a5210b
-
SHA1
e647ff934fc92b65344cb115b35c32e3792d36cc
-
SHA256
f7a2183a529d01b8ddc02990103866057d1084444968e93862bf1f83d2467947
-
SHA512
1d2f5872bea5c9742be431b7c6fdb78bb5b34e37dadf75ae764296681f568a465bb321588b445ff7657db40d1c883512814b6a1ead342624e0b34faaa2a16c60
-
SSDEEP
1536:VxEuAytfJGZfzoGwPZ3kbyZ0nbo2CESOOXEnqjQc8:VDCzLwPZ3kbyUZSOOXDt8
Score10/10-
Detect Xworm Payload
-
Deletes itself
-
Drops startup file
-
Adds Run key to start application
-