Overview

overview

10

Static

static

10

signtool.exe

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    signtool.exe

  • Size

    33KB

  • MD5

    2f3e77d48604ea9af04989146d502d90

  • SHA1

    d964e7b760669d6748fa522b84aa88dff2de5a3d

  • SHA256

    38207ca737ecff8a1d0579efc78fa7ea0a7bf86d0632728f235adf59441bb3fe

  • SHA512

    30612de86536e91b09e89ecb4f08766a04b6fbcd54e6767419fc3b9f7740eb08bff8103f11e99e0b1fe5d41c0919f1e368044e06049f2cf56a65acfbcac9a8ef

  • SSDEEP

    768:+VxijZ0dE3XC42JiB70qVF49jROjhqbi:kijZAqXC4WiR0QF49jROjou

Score
10/10
xworm

Malware Config

Extracted

Family

xworm

Version

5.0

C2

147.185.221.18:7000

18.ip.gl.ply.gg:7000

http://localhost:7000

45.90.161.155:7000

https://adb5-2601-84-8b80-e70-3d2b-c1e2-1722-f6d3.ngrok-free.app:7000

republic-following.gl.at.ply.gg:29121:7000

10.0.0.197:7000

73.33.151.14:7000
Mutex

TPpAUcxxLrNQSpIF

Attributes
  • install_file

    USB.exe

aes.plain

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm family
    xworm
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • signtool.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections