General
-
Target
e7807ac712edf628b46487cc7f881e26.bin
-
Size
46KB
-
MD5
e4f295a9273f7458899293fa93e5d11f
-
SHA1
c61c0a5c4a79b57dd45a5c04daa5d3ee00603efd
-
SHA256
8918aaf410c675ff2fe9bac8c775d1e4942fd6bf8400b1ae4e0ab80b7492f87c
-
SHA512
bdface0b64cfc10e6454e27313a13291005646ba3b9e4a60dc131decf9e4061f0aba03dc57c1c6d27967bb6f52ccae244d1ff79bb02592a05eff29a5d5b538ba
-
SSDEEP
768:FNU7IzKLZbJYJnnpVRG/t9Xoc4VROMelpCqEW9C1l4M9ZG0kqAPUIl/9BLUA:/9WNbInZ6TovkMelgqEW9CcM9KPUIx
Score
10/10
Malware Config
Extracted
Family
xworm
C2
specified-cuba.gl.at.ply.gg:7593
Attributes
-
Install_directory
%LocalAppData%
-
install_file
SystemUp.exe
-
telegram
https://api.telegram.org/bot6247294171:AAHHTNQDiknparTw_3jKn7zIfNlI9f-kRgE/sendMessage?chat_id=5804366993
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
e7807ac712edf628b46487cc7f881e26.bin
Password: infected
-
8f3da1cd07b0b75677db8728683206e463680c0e10333a35ca37977445426e09.exe
Password: infected
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections