Static

static

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    Nursultan.exe

  • Size

    591KB

  • MD5

    cac991521fc4ef792f63f34095be768e

  • SHA1

    cfa9c81c8ef013e75fda541b1b08657a3e009e34

  • SHA256

    da13099ca010f3d9be9d6dbda69cd73bb45b4c202adf3b8063fb9ffca65321d0

  • SHA512

    7213e5ce7d6f200414bf041c3c0e64970f62da8e7f83e5c8a8977cb57ead3ed1bb3f3d119ef33abe84d147a7bc72e2316f235f4e4d719e41d509eb59b41eca5c

  • SSDEEP

    3072:IJSN5Bcb3+XzhQ3OAnnB7Tzg7GHNrWvixYsfcYZo/WSIX73JavDzkRGQ0NyGsW:nKbce1lgQqU

Score
10/10
xworm

Malware Config

Extracted

Family

xworm

Attributes
  • Install_directory

    %AppData%

  • install_file

    svhost.exe

  • pastebin_url

    https://pastebin.com/raw/TPLMtbPZ

  • telegram

    https://api.telegram.org/bot6703282929:AAF2hY1OMrFxboAr60sEUY7lLLOuXWe_gt4/sendMessage?chat_id=1753891600

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm family
    xworm
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • Nursultan.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections