Overview

overview

10

Static

static

10

Nursultan ...e).exe

windows7-x64

6

Nursultan ...e).exe

windows10-2004-x64

6

XClient.exe

windows7-x64

10

XClient.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    Desktop.rar

  • Size

    202KB

  • MD5

    76978b3600e972d12d1d5908d288a547

  • SHA1

    c6c8995de8fa7d099ad9ae59bfc62a4e69a2e014

  • SHA256

    c40ddc154c7b1f2ed75eb71402c4d9d535b04b6981f2ba35b543d13e92517b09

  • SHA512

    04a76d64de347127dfd181621012f57a67e89857177ccf3555a15241880036742b7726f88979b64d8b9a622decd486d0de94ce00ecf7806dd0cc68065a58e4f5

  • SSDEEP

    3072:ks8qbjgwosZWvya69zE0oeiK44wGoyg1CsDolJf8/Vj4BOjEC2umT5XhWFjrU7hk:z4CovyagUms0vfcj4B1JFK0t+oTC

Score
10/10
xworm

Malware Config

Extracted

Family

xworm

Version

5.0

C2

tr3.localto.net:42425:52773

16.ip.gl.ply.gg:52773
Mutex

JVWiY181Z4kxTf0K

Attributes
  • install_file

    USB_Driver.exe

aes.plain

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm family
    xworm
  • Unsigned PE 2 IoCs

    Checks for missing Authenticode signature.

Files

  • Desktop.rar
    .rar
  • Nursultan (Creator Shake).exe
    .exe windows:6 windows x86 arch:x86

    634ebe92c1026fa85f8f7ce5b257e6f1


    Headers

    Imports

    Sections

  • XClient.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections