Overview

overview

10

Static

static

10

SantosExec...er.exe

windows7-x64

10

SantosExec...er.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SantosExecutorInstaller.exe

  • Size

    136KB

  • MD5

    2c2c3af94bc32c880278a8d8c4fa831c

  • SHA1

    1ee1f7b2e91f66c8b79d6bb97924484580a9276d

  • SHA256

    2ab6390fcc902b46d3df5107416223da2d1c275d80aab0b7b7d6c0ee8c219644

  • SHA512

    7a774318d756e673ce761c480530e70f7dfa84ce7aaed162f577f19a4afa237695d9de1e1646019106ef52e8315025ec8ca9e0acd6aba13dd74773c7e9ea0efd

  • SSDEEP

    3072:yOT7HFq9tiUOjoBz65/M6If+3Js+3JFkKeTnE:zRq9LxBt25

Score
10/10
xworm

Malware Config

Extracted

Family

xworm

Version

5.0

C2

introduction-specifications.gl.at.ply.gg:47117

Mutex

OJaM16tyEwtJe5lG

Attributes
  • Install_directory

    %Userprofile%

  • install_file

    svchost.exe

  • telegram

    https://api.telegram.org/bot7098399942:AAGbBTQcHRRS0fdzPhkmgHxFxRybEnM_OnM

aes.plain

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm family
    xworm
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • SantosExecutorInstaller.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections