General
-
Target
tmp
-
Size
148KB
-
MD5
2649ef15cf6004b05c80abd825cd594e
-
SHA1
2593cb7db276d90d51ea5235eb4c14cbd8ecd5a5
-
SHA256
e6f7963c726231571294a06e1e8b1f03b87684cad8383bb194b957fc685685c2
-
SHA512
3b1367d52cb5f99bce35fee1d6414de92a9f10e8df6dfd27c6872e5c4783eba9bd0ed5a6d645fd93b81a064f46a00e25fa6d8404e2881f3006f8b04f2ad67ddc
-
SSDEEP
1536:RQuj357A7FK9fYP063O+xrBOybBYfOS4J+1oEhyiHn:quj5wFK9fYPJO+XtYmS4g+Ehfn
Score
10/10
Malware Config
Extracted
Family
xworm
Version
3.0
C2
157.254.223.19:8081
Mutex
i0Yq2Adr82znjD2G
Attributes
-
Install_directory
%ProgramData%
-
install_file
USB.exe
-
telegram
https://api.telegram.org/bot5498061286:AAEOFPFhizSA_AbkzDV_OWcHlXVsegPpL_c/sendMessage?chat_id=1267602057
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
tmp
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections