General
-
Target
14372316306.zip
-
Size
21KB
-
MD5
973062ba853a5f41f116e99ce4502d65
-
SHA1
25f1898021017b12391ffa29ae4f946356152f44
-
SHA256
4e83621d3391ca47a2539356d20fc48e1f4a9a3f10d5c772168a848ed3b8d6d8
-
SHA512
2215156c07a6788d5492b6bf3b1c0d882ad61472a127ab7d26d0fce81e33cbee03ba52cc19bebf39aabd9a56038292396f1e66a47611ccdcf0d38541514a65eb
-
SSDEEP
384:b9MH41BYTYKbfu+w1Bfu5BjxArM28Wh4GIzD+/nWdDT0fljGTRxQP8zisEB9w:BMHYBYTbbmjBf0BjKY2Vh4MWWlaHQ2iC
Score
10/10
Malware Config
Extracted
Family
xworm
Version
5.0
C2
adyeezy.duckdns.org:5901
Mutex
ru0sAqfVkB5Bv2Jv
Attributes
-
install_file
USB.exe
-
telegram
https://api.telegram.org/bot6894561819:AAECJiuq4XuFRr3lrY2ppEDP4i0wjpFvdok/sendMessage?chat_id=966745293
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
14372316306.zip
Password: infected
-
JAN12-AntiAnalysisXClient.exe
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections