Overview

overview

10

Static

static

10

1820-22-0x...ry.exe

windows7-x64

1820-22-0x...ry.exe

windows10-2004-x64

Sharing

Copy URL Twitter E-mail

General

  • Target

    1820-22-0x0000000000400000-0x0000000000412000-memory.dmp

  • Size

    72KB

  • MD5

    b6b04b58f452dc8d76b41cd2efaff653

  • SHA1

    5a233188cd34bd3cc9436081b048c4b9f77bede7

  • SHA256

    9f640847789fb4b75d258541d3333e49ffcecfde5c5ede7b24661a7400bc4503

  • SHA512

    7c566ab167d022bdf2262e4baa8d006d93c1b5aec1fb9ca8d5dedb4f2c71d201504155fce7ba462de0eae1ec9408f98b924c6e8df80f8f0610b6311975014534

  • SSDEEP

    1536:fOAhAqLa//cYX0PjwzbfZ7Rdgxw6hXOSnN9d:fOAh5La/HX0PczbfZ7QxTXOSd

Score
10/10
xworm

Malware Config

Extracted

Family

xworm

Version

3.1

C2

zafar12.duckdns.org:4444

Attributes
  • Install_directory

    %AppData%

  • install_file

    USB.exe

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm family
    xworm
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 1820-22-0x0000000000400000-0x0000000000412000-memory.dmp
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections