Overview

overview

10

Static

static

10

Nursultan.exe

windows7-x64

10

Nursultan.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    Nursultan.exe

  • Size

    40KB

  • MD5

    eb348050a2dc98f35d3f0acaa68b4385

  • SHA1

    6972486ad5254b20c2ad9cee5ed5bd492ef56163

  • SHA256

    23ff5ec605cc2e4dfcb6909d80a77ad5ada6c2bfa2b407b366e4e7965908872e

  • SHA512

    c296267beb99a5938c2200315ce7584ae8e6a670387181868f28739f894b66d088beb279a101f065a82bc144ab2c425f945b399b36b1e49abf963c4c2e7d66bc

  • SSDEEP

    768:BFyv5LKrcO/Ev6Oe8MbM/gzhBIF5PO9O1K6SOMhx381:BUZucOKO3beFY9mK6SOMTY

Score
10/10
xworm

Malware Config

Extracted

Family

xworm

Version

5.0

Mutex

KORdvbd3dtL4zBLr

Attributes
  • Install_directory

    %AppData%

  • install_file

    NURSULTAN.exe

  • pastebin_url

    https://pastebin.com/raw/RpN22Tm3

aes.plain

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm family
    xworm
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • Nursultan.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections