Overview

overview

10

Static

static

10

896.exe

windows7-x64

10

896.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    896.exe

  • Size

    174KB

  • MD5

    f07dfb8a9ae0fbad3a450a2c87c47ed3

  • SHA1

    a6c9d00cb5e53e8e1249738b83b7b82ffb7a0662

  • SHA256

    762e200fe44a5a176ebb14ee0f34fd57a5733fb2867270eb44a83d6f5d7452db

  • SHA512

    f1b5f8de20a6cf3881ed620d9425ba69a762b8460b1f570f84d3f5ce5af5686a085ac3f5df40b19f5a136dd2262658e590ad4b43e5c66b9357f1d127e5bfdb0a

  • SSDEEP

    3072:798xf++bddMSOs3Z7M+lmsolAIrRuw+mqv9j1MWLQS:7989nbdA+lDAA

Score
10/10
xworm

Malware Config

Extracted

Family

xworm

C2

ezhack-50115.portmap.io:50115

Attributes
  • Install_directory

    %AppData%

  • install_file

    XClient.exe

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm family
    xworm
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 896.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections