Overview

overview

10

Static

static

10

bondswoofer.zip

windows10-2004-x64

10

Resubmissions

25-01-2024 16:55

240125-ve6t9sbah7 10

25-01-2024 16:54

240125-vekxssbag6 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bondswoofer.zip

  • Size

    21KB

  • MD5

    b4c85d93d404345e6dc351c61f74a251

  • SHA1

    964c83fa0df218af152da2b9f73845827cfb5d66

  • SHA256

    c50ed292c51e4e3d3e49903c14ae69615a96de03488804dca59992f9b357df1c

  • SHA512

    bc2f43b97fb0ac1d31140550a6c3a42ad9c56dded5f7f0086e34cda3f81edac1745d5907a4130e0d32c8c2dbdc44b306ec2fd1276c40f10d1096618ce88cf5ad

  • SSDEEP

    384:Ex+ntSN+Y3sv8DIX8mDP17YAwkISjwdbB/gP/YL7kv/UK3xFmY4k9uTPbNdqWtY:EStSN+Y3DIX8mZ7nwIMbBCa7kv/Uqmxq

Score
10/10
xworm

Malware Config

Extracted

Family

xworm

Version

5.0

C2

127.0.0.1:7000

Mutex

2WgM0rfSwbTr1Dvs

Attributes
  • Install_directory

    %AppData%

  • install_file

    XClient.exe

aes.plain

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm family
    xworm
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • bondswoofer.zip
    .zip

    Password: fr

  • bondswoofer/PLEASE READ.txt
  • bondswoofer/bondswoofer.exe
    .exe windows:4 windows x86 arch:x86

    Password: fr

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections