General
-
Target
llllllllll.exe
-
Size
37KB
-
MD5
3af9d070039f625f6add80fa0fbf32d6
-
SHA1
e6d9dd4efc7bb54395cb2874212eebaa867bc1d4
-
SHA256
3cb84f94ef2f910e0c96e2ea3a4c54592e4f2bb877644df9787cae864ddd0e6d
-
SHA512
57e2a22328f9f4f6bdabfafabfc0814614706280788583d04d1526fa9f9d578e7b122bc6067a1d0f42404e270094b445dfc7b5d13caa8a80411296c44d6873d0
-
SSDEEP
768:ZXX1qlm/G4iHEq5uvg8lme3qJy1UraNIgLFyS9fROjhaPyz:ZVqlX20c8iU2NJFf9fROjc6
Score
10/10
Malware Config
Extracted
Family
xworm
Version
5.0
C2
62.233.57.44:1488
Mutex
LF9KSE0Q1C7p71Nz
Attributes
-
Install_directory
%AppData%
-
install_file
svchost.exe
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
llllllllll.exe
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections