Overview

overview

10

Static

static

10

checkthis.exe

windows10-1703-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    checkthis.exe

  • Size

    96KB

  • MD5

    487ad3e5c2cd918293c4aaa849afa7c9

  • SHA1

    78a950c0bb4be7c3487612920d2398d3fd389522

  • SHA256

    74fd0a9ba69520b1814c9316cab09b457fe8e432352d54e455ac1d198cfb1a4f

  • SHA512

    814083b5bfeeb0007c85e529aedd316995807691b75b69b59853dbd3a57d2c34e68296b13f3b2d4b88327a85305bd497044e61219786ba7f6abd2a7170750cc4

  • SSDEEP

    3072:6ibQUcV3uB8j6Qb0G7xms7SAGdIzCuOX0mFQUq:6xUxrQb7moSRVHd2U

Score
10/10
xworm

Malware Config

Extracted

Family

xworm

C2

8.tcp.ngrok.io:12412

Attributes
  • Install_directory

    %Userprofile%

  • install_file

    svchost.exe

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm family
    xworm
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • checkthis.exe
    .exe windows:4 windows x86 arch:x86

    Password: 12345

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections