General

  • Target

    free bobux.exe

  • Size

    75KB

  • MD5

    3c2e0ad83c6da0ac6645ff12843fdc08

  • SHA1

    fc6967dceff82daca30261c2dc9437aafed9d695

  • SHA256

    b9312d357ef454cc33c43ba3d121bae99ffd0a215e1f80b13fac99f13d61af3c

  • SHA512

    a59ae70fff6098fc85ff1f2f2c0b815c3a8aeb3e0bbbcb8ac3a732fcd783ddc6f8406409d5c1bce3f5c7f35fdcdc3564d1e2137507983ff667c14c2f811cc8d6

  • SSDEEP

    1536:BCryEnUq2mKmzlWe0XhDb/szBxTYhOYr31kgrU:Mr17RKKwb/s1xOOYr3aD

Score
10/10

Malware Config

Extracted

Family

xworm

Attributes
  • Install_directory

    %ProgramData%

  • install_file

    SysWOW32.exe

  • pastebin_url

    https://pastebin.com/raw/p0NArAB0

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • free bobux.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections