Overview

overview

10

Static

static

10

e6f7963c72...c2.exe

windows7-x64

10

e6f7963c72...c2.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    cc7cf0c410697552614fd56ffc8f26b3048f4f4e8ba5ff84c302f0959e7f0859

  • Size

    42KB

  • MD5

    55c2ad4ab1b62937b8978fac99a6e66b

  • SHA1

    538970df6155b84e535036669f2b1e4c386f8947

  • SHA256

    cc7cf0c410697552614fd56ffc8f26b3048f4f4e8ba5ff84c302f0959e7f0859

  • SHA512

    373740088c3c0f4f5e290f7bf7de5d87a800682792c9081cce9556511ae84c31fc27a8513c120dd8974fb46d0592d7eff259f1e8d9b0718c8a1a7d177b7b8bb5

  • SSDEEP

    768:0i8ml4xBg5oHFpDIWlFNKMP2QLqaYeNf8LS/mig6qxSTZQWiF7:gkMhHFpD7FIMPQ8UL+dPqCZQ7

Score
10/10
xworm

Malware Config

Extracted

Family

xworm

Version

3.0

C2

157.254.223.19:8081

Mutex

i0Yq2Adr82znjD2G

Attributes
  • Install_directory

    %ProgramData%

  • install_file

    USB.exe

  • telegram

    https://api.telegram.org/bot5498061286:AAEOFPFhizSA_AbkzDV_OWcHlXVsegPpL_c/sendMessage?chat_id=1267602057

aes.plain

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm family
    xworm
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • cc7cf0c410697552614fd56ffc8f26b3048f4f4e8ba5ff84c302f0959e7f0859
    .zip

    Password: infected

  • e6f7963c726231571294a06e1e8b1f03b87684cad8383bb194b957fc685685c2.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections