General

  • Target

    0ff99744640716d98efecc6eea41f1fb.bin

  • Size

    17KB

  • MD5

    cf471ee7850ff77effa2dc4c68801750

  • SHA1

    acb4692a06012c92db01804199ab92e65226c8f0

  • SHA256

    7e208fc94c4e1affd1c47088b0b36c0db31392db9beec537fcc4ccd4d417cfac

  • SHA512

    df51b38cd07ec3d9493c5ff71db6201b5298a8d763beeaa8de29e8843c35cc77b0324fbea1b8636b30caedd56c6a86cefdfae840e4e778fecf68b1d67b27ebd3

  • SSDEEP

    384:7RyznZal0lV6N2qD7XrzENnYd2lxQubir:1yzZalG6N2qD/zENn1Qbr

Score
10/10

Malware Config

Extracted

Family

xworm

Version

5.0

C2

191.55.116.39:5552

Mutex

2RTcguMFH1NFy3yF

Attributes
  • install_file

    USB.exe

aes.plain

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 0ff99744640716d98efecc6eea41f1fb.bin
    .zip

    Password: infected

  • 329d5bf6b075b637720e8cd7cf82b170d4f8dc7b1dc8917bdbecd3ae58a74d8e.dll
    .dll windows:4 windows x86 arch:x86

    Password: infected

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections