Overview

overview

10

Static

static

10

bull.exe

windows7-x64

10

bull.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    bull.exe

  • Size

    193KB

  • MD5

    c02fcb47dbcee1627bb815e13b702d68

  • SHA1

    5ce2e7e061fcf28a64c8a7cc0ce3e496e706685d

  • SHA256

    b499e3ca6d662869baafa1ce36799f272b893b4c92751763bda78ad8bdaacdc3

  • SHA512

    abfd9fde8063acc29bc4f390ad8e2883bf84dc0e2978b3e31a698481827faab4c46439bef3900e247891f9a2521e39f2bf0fe320368d81559a2bdd809a4793c9

  • SSDEEP

    3072:X4g6hHrnaWRbywYRUUIOqd+4NpVq8BxFRzaqF+o2GQJ7/JzqVfGvf:XwJaWRbTYRUUg+gVqwlL

Score
10/10
xworm

Malware Config

Extracted

Family

xworm

C2

https://pastebin.com/raw/mfW9zYDR:8080

Attributes
  • Install_directory

    %AppData%

  • install_file

    XClient.exe

  • pastebin_url

    https://pastebin.com/raw/mfW9zYDR

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm family
    xworm
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • bull.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections