Overview

overview

10

Static

static

10

tmp.exe

windows7-x64

10

tmp.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    tmp

  • Size

    235KB

  • MD5

    715d9e1786839981fc5aa6ec4c9df1a6

  • SHA1

    e4f3d03f3e92faa404669b55c7c28aba157a44ac

  • SHA256

    9d4991393962992db54a17e7aad1152a8965c3d51ac309d35768953f7e20dac5

  • SHA512

    be181551a7c705e9b18c812defbc86790bd32f67da474e61dd07fc8cd36030b58e7cf908a1db2fe826ec0ec8ed3d08c0b42bda1a8731213424ba7e5ef477c534

  • SSDEEP

    3072:FjToRFRb8MPOin68SKfbzxcwg7es6/Vsb8VKTu549oJMfF/H9N3Ky9NzLnQ:2RFRbVX6UhcX7elbKTua9bfF/H9d9n

Score
10/10
xworm

Malware Config

Extracted

Family

xworm

Version

5.0

C2

127.0.0.1:8888

93.123.85.68:8888
Attributes
  • Install_directory

    %ProgramData%

  • install_file

    WinRar.exe

  • telegram

    https://api.telegram.org/bot5831501082:AAELkQ6xM7p_N7x74e8Xrku-_ibYekoBMcY

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm family
    xworm
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • tmp
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections