Overview

overview

10

Static

static

10

552cfe1d32...a6.exe

windows7-x64

10

552cfe1d32...a6.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0acba1286459f5cb25abaf5af57d1fc75b720d8da7adfe2dda683dfb43931d14

  • Size

    17KB

  • MD5

    d8b49c70a0bd95597c4304f9ebe13561

  • SHA1

    9a8f689518979a64dd0e3b9e1a7e3ebb269ce394

  • SHA256

    0acba1286459f5cb25abaf5af57d1fc75b720d8da7adfe2dda683dfb43931d14

  • SHA512

    bd5076ac0ab380c05376cef22f018ced3c718e4cb75e8b91a11e625ecb9540b60424e558236dde14451cc6cc9f6043458519567640687442029dd6603e476c1c

  • SSDEEP

    384:/BUEZb0Tvk1gqs+8x6ry+YUuWDhs0FEG64Gv9/Ytb:5LaT8DSmYZIhs0FU4u9/Ytb

Score
10/10
xworm

Malware Config

Extracted

Family

xworm

Version

3.1

C2

janxworm9090.duckdns.org:9090

Mutex

Xa2HMWUMGteOPIQ2

Attributes
  • Install_directory

    %AppData%

  • install_file

    USB.exe

aes.plain

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm family
    xworm
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 0acba1286459f5cb25abaf5af57d1fc75b720d8da7adfe2dda683dfb43931d14
    .zip

    Password: infected

  • 552cfe1d324eabb78511924dbbbf870fe10fe742d88a708f0012f47091ec04a6.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections