General

  • Target

    1256-4800-0x0000000000400000-0x0000000000410000-memory.dmp

  • Size

    64KB

  • MD5

    9a03720510ed6a4b25a7604e7a33086e

  • SHA1

    8034a9d0c5b6b890887d4eeb7d1909fe0d10db91

  • SHA256

    27960f379f716458179bb2ecf6c39e8013f0bd7f178f903b8d5478e83600571f

  • SHA512

    0769ede3c0a5e59ce4296154479af00817eac2651abb7c517e483847e45d98cf91c188be8ab13e8cad4f7ba758b08647ce3f1576c365488ee53a9689d3802e45

  • SSDEEP

    768:NyfuON2F8DwO/hKXf/qkbht83qFS9xM6OO+h1FDJ:QmON2FvehKXv/FS9xM6OO+vP

Score
10/10

Malware Config

Extracted

Family

xworm

Version

5.0

C2

103.78.0.137:5151

Mutex

dK3Ts1K6YgDeZRUF

Attributes
  • install_file

    USB.exe

aes.plain

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 1256-4800-0x0000000000400000-0x0000000000410000-memory.dmp
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections