General
-
Target
qaz.exe
-
Size
48KB
-
MD5
676a07c74e4487abada569413214be3f
-
SHA1
82ff0ba18b54f37b3703ea15b3414d735bd50827
-
SHA256
01072fd48095c4819ac6f11317706a90b0e476b3028cb2b0a628834061e03514
-
SHA512
71da9be9e00c19b07ea123a69fa29cc3ce08938f0e82abce58eff3e7c783e1595f1945ea2638bc010860278175694e0dc73b9de356aae1ea2f5e6c8ee1104439
-
SSDEEP
768:a0GwCSArxzUa65wdbDi3TeRb/m9eMF4TLFWt9jCU1A6OOAhx0Xj78ZCn:iZ99R6A9O9fF2FY9jCU1A6OOAv0Egn
Score
10/10
Malware Config
Extracted
Family
xworm
Version
5.0
C2
127.0.0.1:7000
91.92.252.220:7000
41.199.23.195:7000
saveclinetsforme68465454711991.publicvm.com:7000
Mutex
wgRrsTR2yhDOozrq
Attributes
-
Install_directory
%AppData%
-
install_file
explorer.exe
-
telegram
https://api.telegram.org/bot2128988424:AAEkYnwvOQA95riqRZwlqBxg4GV-odRNOyo/sendMessage?chat_id=966649672
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
qaz.exe
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections