Overview

overview

10

Static

static

10

Removed.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    Removed.exe

  • Size

    236KB

  • MD5

    e451ef76e761612bdfd839257f1d8cdf

  • SHA1

    aeb07ef70f473ecba87e710915dc0b2d9706c645

  • SHA256

    a0fa26e1b1fe78b1d862cc453dbf93e1b39b050948bce38571343183f1a5ef3c

  • SHA512

    39cdbc383985975795c58b242de23793f591fa4f9457b0214ed4766a58e4640fcafd4c8019fbf0a8c8761409cf91f9381be309d4c34dbdbfd4ac60c2e1c814c6

  • SSDEEP

    6144:5Srst91bhbvkUhcX7elbKTua9bfF/H9d9n:cIk3X3u+

Score
10/10
xworm

Malware Config

Extracted

Family

xworm

C2

45.137.70.103:7000

Attributes
  • Install_directory

    %AppData%

  • install_file

    Runtime Broker.exe

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm family
    xworm
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • Removed.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections