General
-
Target
b780f8659c3cfab33ffa95b25b396b2b8ade8bd40c72aaf7c87ad3c6b6cf34c5
-
Size
50KB
-
MD5
17eefbaaa30123fa3091add80026aed4
-
SHA1
8e43d736ea03bd33de5434bda5e20aae121cd218
-
SHA256
b780f8659c3cfab33ffa95b25b396b2b8ade8bd40c72aaf7c87ad3c6b6cf34c5
-
SHA512
e82fbbbfef61773fae1ed3e0767efa225ede0327ca5654de25e86359f4366942f85cf5542e67a52b24bb129d7fccf09fc68c64a73cf9269a75040d888005fa09
-
SSDEEP
768:C/ul3bG/lNZeBFjzdG514y9iIn0N+LJwdFNt9cHydAQ6vOAh3HVXj+T3m:aulrukLdQ142uNBFf9iG6vOAhVST3m
Score
10/10
Malware Config
Extracted
Family
xworm
Version
5.0
C2
127.0.0.1:7000
91.92.252.220:7000
41.199.23.195:7000
saveclinetsforme68465454711991.publicvm.com:7000
Mutex
bBT8anvIxhxDFmkf
Attributes
-
Install_directory
%AppData%
-
install_file
explorer.exe
-
telegram
https://api.telegram.org/bot2128988424:AAEkYnwvOQA95riqRZwlqBxg4GV-odRNOyo/sendMessage?chat_id=966649672
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
b780f8659c3cfab33ffa95b25b396b2b8ade8bd40c72aaf7c87ad3c6b6cf34c5
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections