General
-
Target
868d1dc8e8f5bd6a78f0eabc2b59aff0.bin
-
Size
44KB
-
MD5
92e80b35e64eacdf45a438791070cd0f
-
SHA1
223eed14356c50d13370c118b773ab452d89b9dd
-
SHA256
c27e0cd9fba38da586146d39078f35000db14584882fd0edb2d7273b5ba8d003
-
SHA512
fa9c677be5368dfcf0ab927e70a21972608240e65472313de3cf845bca70ab412f5dc8c170e8b520ac03993a1640763d10dcc49c3c5586eb8b0259a8bc3527d4
-
SSDEEP
768:REIWzDz9BeTbAA0TM4ZiTWQXIzWf3QjOTazCKvUJ7ROHMaNkX76sl:RCzDenATZCWQGqVT968tOHvkXGsl
Score
10/10
Malware Config
Extracted
Family
xworm
C2
146.190.57.132:7000
Attributes
-
install_file
USB.exe
-
telegram
https://api.telegram.org/bot6491699241:AAEzWMqxLHLa_DADVhFrtpk__NqYBpyS7tI/sendMessage?chat_id=6432387334
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
868d1dc8e8f5bd6a78f0eabc2b59aff0.bin
Password: infected
-
8c638422d668f0b55ab3f644948440745ae847eb7bc3d516d7bc0953a96dcede.exe
Password: infected
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections