Overview

overview

10

Static

static

10

2024-05-06...ar.exe

windows7-x64

10

2024-05-06...ar.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    2024-05-06_28bedec9d19a49e4f310369176bc85c8_hiddentear

  • Size

    136KB

  • MD5

    28bedec9d19a49e4f310369176bc85c8

  • SHA1

    b1fa8877122fdcb916639652983bc942ced62579

  • SHA256

    05cf19041480edb2dd230f8c8afdb15eadb51aae5609aa0483e04e40e763eaee

  • SHA512

    8822a2f200c1151533c103dee8c1db28176eb6fb220b3c7c4f05a74d3702a3c1e7ef681f75ba26f83f97af1f4824940601be253ad0d0e8bb7a5d4c91c4dac222

  • SSDEEP

    3072:17oFv9m/OwQM+lmsolAIrRuw+mqv9j1MWLQj:1Gv9Y+lDAA

Score
10/10
xworm

Malware Config

Extracted

Family

xworm

Version

5.0

Mutex

aZjFC852BmWn2sTs

Attributes
  • Install_directory

    %AppData%

  • install_file

    Wordpad.exe

  • pastebin_url

    https://pastebin.com/raw/wbntEpyg

aes.plain

Signatures

  • Detect Xworm Payload 1 IoCs
  • Detects Windows executables referencing non-Windows User-Agents 1 IoCs
  • Xworm family
    xworm
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2024-05-06_28bedec9d19a49e4f310369176bc85c8_hiddentear
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections