Overview

overview

10

Static

static

10

531fb63826...1a.exe

windows7-x64

10

531fb63826...1a.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    df6e8e8955acdb9b0864f25d442f43c5.bin

  • Size

    16KB

  • MD5

    ff87f5cb8a1ee0cacfa03c5423a7898d

  • SHA1

    6a94390078ffd99fcb2593faf973df4aee53b6a5

  • SHA256

    52881fc4885ad98e4f5ec62c4c03b624bc74fc9f148f4af945c4c73b870b3bca

  • SHA512

    9ebba1f5a88e3b2474d7e44a992af32f69af2cdff37f3ef282d8fcf06bdb24106c1f7b60e70e4473821de6686c14d657e20b6ed7920e25d1e33f77be40673f99

  • SSDEEP

    384:dDXR3YlYiHeBIAdOrX9o2Eq5BOy8RbdQPyA76RFOt/:dDR3Y+iHSXuN9EGZ8J0UFw

Score
10/10
xworm

Malware Config

Extracted

Family

xworm

Version

5.0

C2

warzones12.duckdns.org:7000

Mutex

zE2l9o6TPb8JbyzU

Attributes
  • install_file

    USB.exe

aes.plain

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm family
    xworm
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • df6e8e8955acdb9b0864f25d442f43c5.bin
    .zip

    Password: infected

  • 531fb63826f4d36eb31debe554073a4f4a73eaca264699b21e24e912b831f81a.exe
    .exe windows:4 windows x86 arch:x86

    Password: infected

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections