General
-
Target
X1.exe
-
Size
47KB
-
MD5
2ab2f26ab78dbd53cea3b71c00d568c2
-
SHA1
53f0a2fdde2f1fe6e1ad44b87b8325624cdeb3fa
-
SHA256
1f204b43acfdf5d1088f37b2159d98d5500bdaeec99cd3f0d6e8ceb77282351b
-
SHA512
677cf83b6ed165d8ba5734e95bb1b53305cc69cd6a98edd26f2d8ca75978828d734b36739dbb58bf5b7830fe9c6ff894d4d9bf2aebe7285ba1c7de73f5c90e8d
-
SSDEEP
768:Jl9f2fd1G1JlnDs8PvGT0Wk8Q0SSP9wTwTLuHFNg9hR8We6+OAhSYgX7WsP6:5ujG1JBDvTn0mwOFW9QWe6+OA7gRi
Score
10/10
Malware Config
Extracted
Family
xworm
Version
3.1
C2
91.92.252.220:4442
Mutex
wR68bAqsujrl6VoA
Attributes
-
Install_directory
%AppData%
-
install_file
explorer.exe
-
telegram
https://api.telegram.org/bot2128988424:AAEkYnwvOQA95riqRZwlqBxg4GV-odRNOyo/sendMessage?chat_id=966649672
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
X1.exe
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections