General

  • Target

    Tamali_Botter_and_LOIC.rar

  • Size

    102.7MB

  • MD5

    18976417e5e73b22bc4f82b03701a531

  • SHA1

    85ef10fe66df7f01a9575c5aef357c51bb708e91

  • SHA256

    ce035e5538dd434de118d9a8565c60f24713119ae9fb5f72d99b38ccdc1580b6

  • SHA512

    0fea196191b235dcb1e4b4b50c552e2065de4a4e2700f029cf1d434ae960168d3628ae3d93e75a5fab3436fa0eafd95844432bd44bad74b3f844ced1f6f86893

  • SSDEEP

    3145728:NxbaoYOp39uAykjf8HtXi6xsrrrUmdDuaHL0wXDU:NNaohdykrUXiL/UW9VA

Score
10/10

Malware Config

Extracted

Family

xworm

Version

5.0

C2

127.0.0.1,147.185.221.16,qadr-38189.portmap.host,40164:40164

Attributes
  • telegram

    https://api.telegram.org/bot0xfC5c089DAeb8A17D06fbDa9B1285737C13429113/sendMessage?chat_id=6200390688:AAGQXodp6n3MHi-Q9hqn4B3BGpjnmSz3dq4

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm family
  • Unsigned PE 8 IoCs

    Checks for missing Authenticode signature.

Files

  • Tamali_Botter_and_LOIC.rar
    .rar
  • BOTTER AND DDOSER/BOTTER/LICENSE
  • BOTTER AND DDOSER/BOTTER/LICENSES.chromium.html
  • BOTTER AND DDOSER/BOTTER/Peter Bot.exe
    .exe windows:5 windows x64

    9f9c967fe6d2c8482cb4e000bbd84034


    Headers

    Imports

    Exports

    Sections

  • BOTTER AND DDOSER/BOTTER/chrome_100_percent.pak
  • BOTTER AND DDOSER/BOTTER/chrome_200_percent.pak
  • BOTTER AND DDOSER/BOTTER/d3dcompiler_47.dll
    .dll windows:10 windows x64

    dc71769f237c0a3ba38879380c54a4e6


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • BOTTER AND DDOSER/BOTTER/example_macro.txt
  • BOTTER AND DDOSER/BOTTER/ffmpeg.dll
    .dll windows:5 windows x64

    14338d2168d869b1b53d66354179e8c5


    Headers

    Imports

    Exports

    Sections

  • BOTTER AND DDOSER/BOTTER/free_proxies.txt
  • BOTTER AND DDOSER/BOTTER/free_usernames.txt
  • BOTTER AND DDOSER/BOTTER/icudtl.dat
  • BOTTER AND DDOSER/BOTTER/irdnv.exe
    .exe windows:4 windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • BOTTER AND DDOSER/BOTTER/libEGL.dll
    .dll windows:5 windows x64

    592e6e55d4fe33d1bd84e3b3016fe3b2


    Headers

    Imports

    Exports

    Sections

  • BOTTER AND DDOSER/BOTTER/libGLESv2.dll
    .dll windows:5 windows x64

    b3384e5182b61c941805b07b7dc28efe


    Headers

    Imports

    Exports

    Sections

  • BOTTER AND DDOSER/BOTTER/locales/af.pak
  • BOTTER AND DDOSER/BOTTER/locales/am.pak
  • BOTTER AND DDOSER/BOTTER/locales/ar.pak
  • BOTTER AND DDOSER/BOTTER/locales/bg.pak
  • BOTTER AND DDOSER/BOTTER/locales/bn.pak
  • BOTTER AND DDOSER/BOTTER/locales/ca.pak
  • BOTTER AND DDOSER/BOTTER/locales/cs.pak
  • BOTTER AND DDOSER/BOTTER/locales/da.pak
  • BOTTER AND DDOSER/BOTTER/locales/de.pak
  • BOTTER AND DDOSER/BOTTER/locales/el.pak
  • BOTTER AND DDOSER/BOTTER/locales/en-GB.pak
  • BOTTER AND DDOSER/BOTTER/locales/en-US.pak
  • BOTTER AND DDOSER/BOTTER/locales/es-419.pak
  • BOTTER AND DDOSER/BOTTER/locales/es.pak
  • BOTTER AND DDOSER/BOTTER/locales/et.pak
  • BOTTER AND DDOSER/BOTTER/locales/fa.pak
  • BOTTER AND DDOSER/BOTTER/locales/fi.pak
  • BOTTER AND DDOSER/BOTTER/locales/fil.pak
  • BOTTER AND DDOSER/BOTTER/locales/fr.pak
  • BOTTER AND DDOSER/BOTTER/locales/gu.pak
  • BOTTER AND DDOSER/BOTTER/locales/he.pak
  • BOTTER AND DDOSER/BOTTER/locales/hi.pak
    .ps1
  • BOTTER AND DDOSER/BOTTER/locales/hr.pak
  • BOTTER AND DDOSER/BOTTER/locales/hu.pak
  • BOTTER AND DDOSER/BOTTER/locales/id.pak
  • BOTTER AND DDOSER/BOTTER/locales/it.pak
  • BOTTER AND DDOSER/BOTTER/locales/ja.pak
  • BOTTER AND DDOSER/BOTTER/locales/kn.pak
  • BOTTER AND DDOSER/BOTTER/locales/ko.pak
  • BOTTER AND DDOSER/BOTTER/locales/lt.pak
  • BOTTER AND DDOSER/BOTTER/locales/lv.pak
    .ps1
  • BOTTER AND DDOSER/BOTTER/locales/ml.pak
  • BOTTER AND DDOSER/BOTTER/locales/mr.pak
  • BOTTER AND DDOSER/BOTTER/locales/ms.pak
  • BOTTER AND DDOSER/BOTTER/locales/nb.pak
  • BOTTER AND DDOSER/BOTTER/locales/nl.pak
  • BOTTER AND DDOSER/BOTTER/locales/pl.pak
  • BOTTER AND DDOSER/BOTTER/locales/pt-BR.pak
  • BOTTER AND DDOSER/BOTTER/locales/pt-PT.pak
  • BOTTER AND DDOSER/BOTTER/locales/ro.pak
  • BOTTER AND DDOSER/BOTTER/locales/ru.pak
  • BOTTER AND DDOSER/BOTTER/locales/sk.pak
  • BOTTER AND DDOSER/BOTTER/locales/sl.pak
  • BOTTER AND DDOSER/BOTTER/locales/sr.pak
  • BOTTER AND DDOSER/BOTTER/locales/sv.pak
  • BOTTER AND DDOSER/BOTTER/locales/sw.pak
  • BOTTER AND DDOSER/BOTTER/locales/ta.pak
  • BOTTER AND DDOSER/BOTTER/locales/te.pak
  • BOTTER AND DDOSER/BOTTER/locales/th.pak
  • BOTTER AND DDOSER/BOTTER/locales/tr.pak
  • BOTTER AND DDOSER/BOTTER/locales/uk.pak
  • BOTTER AND DDOSER/BOTTER/locales/ur.pak
  • BOTTER AND DDOSER/BOTTER/locales/vi.pak
  • BOTTER AND DDOSER/BOTTER/locales/zh-CN.pak
  • BOTTER AND DDOSER/BOTTER/locales/zh-TW.pak
  • BOTTER AND DDOSER/BOTTER/resources.pak
  • BOTTER AND DDOSER/BOTTER/resources/app.asar
  • BOTTER AND DDOSER/BOTTER/snapshot_blob.bin
  • BOTTER AND DDOSER/BOTTER/v8_context_snapshot.bin
  • BOTTER AND DDOSER/BOTTER/version
  • BOTTER AND DDOSER/BOTTER/vk_swiftshader.dll
    .dll windows:5 windows x64

    c6d5499631d983c25f3393a4b4b13399


    Headers

    Imports

    Exports

    Sections

  • BOTTER AND DDOSER/BOTTER/vk_swiftshader_icd.json
  • BOTTER AND DDOSER/BOTTER/vulkan-1.dll
    .dll windows:5 windows x64

    49ed29c3ff417b26c7cd92ecc9b7dcb3


    Headers

    Imports

    Exports

    Sections

  • BOTTER AND DDOSER/LOIC DDOSER/LOIC.exe
    .exe windows:4 windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • BOTTER AND DDOSER/LOIC DDOSER/LOIC.exe.sig
  • BOTTER AND DDOSER/LOIC DDOSER/LOIC.pdb.sig