General
-
Target
13c04a34f3029a9a74d313e085238ce28126dbd35e0e051fc3290d83919ba4d1
-
Size
214KB
-
MD5
dd40670405de5b8f1d96db603f68cadc
-
SHA1
e17e7e48b69e6e295d035ccd68b0394a7f4120a8
-
SHA256
13c04a34f3029a9a74d313e085238ce28126dbd35e0e051fc3290d83919ba4d1
-
SHA512
c09c140263bd4b8f7aaef0a84e5192a9110f7fa3c4b68fe3f2793ee80ae120350831d285106749f1c20501193e590d7a747ada0799e7a287833d78e31859488e
-
SSDEEP
3072:Vy96w2rjPzx9bilHueZJuJOroOWERUGKXs+S++7KFSbxeY+qDDrMo:V/n7bAueZDgGqStKEbxI
Score
10/10
Malware Config
Extracted
Family
xworm
Version
5.0
C2
blacksudo.duckdns.org:7000
Attributes
-
Install_directory
%AppData%
-
install_file
msedge.exe
-
telegram
https://api.telegram.org/bot6984284905:AAF5YUF579l1YzOin3UAD9mHnCAXXojq1dI/sendMessage?chat_id=5205734226
Signatures
-
Detect Xworm Payload 1 IoCs
-
Detects Windows executables referencing non-Windows User-Agents 1 IoCs
-
Detects executables using Telegram Chat Bot 1 IoCs
-
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
13c04a34f3029a9a74d313e085238ce28126dbd35e0e051fc3290d83919ba4d1
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections