Overview

overview

10

Static

static

10

1edc62a2db...cc.exe

windows7-x64

10

1edc62a2db...cc.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    2861a0a1c19facc1bafe7923b537722a000ac070c0636435c74aede66150892e

  • Size

    117KB

  • MD5

    d09909b35b3f5be88a9555b1d783c297

  • SHA1

    8affbd2469b86938fbe72a66e0163ff130b9cd4a

  • SHA256

    2861a0a1c19facc1bafe7923b537722a000ac070c0636435c74aede66150892e

  • SHA512

    03d14d18dd40270aa4a5e8f5ae1b710e5ae5cce792c6dc115380c6ba63416d5d0bc5343338189daf1ac79b1005d8b45e82cd8f798655597a511fa22209e5f8ca

  • SSDEEP

    3072:izlQJaFqEaGy2fFZ8Mg1fR5egTwLDUkDDhEnwG73whh:CQJaFq5UoR5egTKDUkDDGwGbwhh

Score
10/10
xworm

Malware Config

Extracted

Family

xworm

Version

3.1

C2

kids-abstract.at.ply.gg:26193

Attributes
  • Install_directory

    %LocalAppData%

  • install_file

    MSASCuL.exe

  • telegram

    https://api.telegram.org/bot6118963747:AAFPoeeAyXiG-pd4NsJhnJCS9gC7YtmGuis/sendMessage?chat_id=5210247710

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm family
    xworm
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2861a0a1c19facc1bafe7923b537722a000ac070c0636435c74aede66150892e
    .zip

    Password: infected

  • 1edc62a2dba3597ba6db98cb33acc828780ba4a10088081645c78c36eecafccc.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections