Overview

overview

10

Static

static

10

0ba6420218...3d.exe

windows7-x64

10

0ba6420218...3d.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    371d449863d10d5108469abec7c545dfc618d519fb609266598d149d5a78bb73

  • Size

    18KB

  • MD5

    fd30e3f2d25b8655511a7f5f97ccd01e

  • SHA1

    2ee251515117d0191362daeccbdc8d1c46d9d97b

  • SHA256

    371d449863d10d5108469abec7c545dfc618d519fb609266598d149d5a78bb73

  • SHA512

    098fd8c5178b85dc05fdf27a542cfaa52b51261ce31064fe01a5000b4f2259e78392c9bbabd37aebf1997d6e22c6eef10e902f8a9086caaa24df44e21a4d25fa

  • SSDEEP

    384:oV5KASu+3MFqxsYAbY//H2TPj2kkf6E+sOhVK04/6PmWtoNb5yQuWvRWYwen:oV5KASun1YAbD7qZXehYJ/SmWtoN9Tv5

Score
10/10
xworm

Malware Config

Extracted

Family

xworm

Version

5.0

C2

137.184.9.205:7000

Mutex

bV5QPxwLtEpuTDDi

Attributes
  • install_file

    USB.exe

  • telegram

    https://api.telegram.org/bot6567817661:AAEPVH8mr4mtxVjaqzlho_8xxGuixiJIukE

aes.plain

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm family
    xworm
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 371d449863d10d5108469abec7c545dfc618d519fb609266598d149d5a78bb73
    .zip

    Password: infected

  • 0ba64202181094b72f8db073c627de074bd18ef9f977d42e12de6d6478ff283d.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections