Overview

overview

10

Static

static

10

behruzlox.exe

windows7-x64

10

behruzlox.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    behruzlox.exe

  • Size

    346KB

  • MD5

    d5dd053d3f41c6aa4610faaa4bfdaaf8

  • SHA1

    726bce27f04013d5c2b0518ab47d651d2809ec65

  • SHA256

    747b515c48f022762e1af1b03b23c660e476cd90993378faff5db7af26038daf

  • SHA512

    99ab90a65f0ad83f4ba1a05959d57e4ef8f6a7514c851d35260e5a0fd3e93273015f89feb8546c6f5dee96c890eaae7c53f3e999eae7543e0e59e228ea395eb2

  • SSDEEP

    6144:L1pumib86Swi+GIIIIIIIhIIIIIIIIIIIIIIIU:LiC6Swt

Score
10/10
xworm

Malware Config

Extracted

Family

xworm

C2

https://pastebin.com/raw/H3wFXmEi:1234567890

Attributes
  • Install_directory

    %ProgramData%

  • install_file

    behruzlox.exe

  • pastebin_url

    https://pastebin.com/raw/H3wFXmEi

  • telegram

    https://api.telegram.org/bot7040341187:AAFniVO-r2v2WwYb_uoYlYVhJB03g-TInn4/sendMessage?chat_id=1234567890

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm family
    xworm
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • behruzlox.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections