Overview

overview

10

Static

static

10

2584-17-0x...ry.exe

windows7-x64

2584-17-0x...ry.exe

windows10-2004-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2584-17-0x0000000000400000-0x000000000042A000-memory.dmp

  • Size

    168KB

  • MD5

    4d460ec16c8f1f91883b286d077291e8

  • SHA1

    ee932e1ae5a344e15006a9b48579954cbd01fbcb

  • SHA256

    6d9aa725b256cedc66005bdddd9357e3882e87666599711e94a9aafd8c10cc1c

  • SHA512

    7e74ac9990a8c3a5afb3d0036bb3ea9507982b424ccc878173cba508a5c7403550cd3bc2a93603273b93872d5978b355024f18346d6dbaf867247762e8da47c2

  • SSDEEP

    768:mL6ktTxhUjNfazq+zSPYri0KW/aPhTJbu0zHFNN9Gut6ZOshgYgXL1xg:mfT5m0KnJbdFj9Jt6ZOsNg

Score
10/10
xworm

Malware Config

Extracted

Family

xworm

Version

3.1

C2

103.67.163.156:80

Mutex

0vCfP4ksGrHZDIUe

Attributes
  • Install_directory

    %AppData%

  • install_file

    USB.exe

aes.plain

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm family
    xworm
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2584-17-0x0000000000400000-0x000000000042A000-memory.dmp
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections