Overview

overview

10

Static

static

10

svchost.exe

windows7-x64

10

svchost.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    svchost.exe

  • Size

    38KB

  • MD5

    664ff88f6fe71f59d23e5439b466faf5

  • SHA1

    65cf283a57555381b31b8ee8054a5676aa9f1e09

  • SHA256

    31954ab9f960f8ce45415bdf50b7854acf3a123a348d21e5d4b3b1cb41e52308

  • SHA512

    b8eefa7f9954c951946d83bad28f1a72aa1aa17738c6258d5b4e221da2e69a5785b0804904fc5464739120e5f706d93db67a599e81dcf410f19e24d89d81d179

  • SSDEEP

    768:LONIVARkWS9GriohlJx3yFZV9366YO1hPRP1:6NIVAR6+VAFL9366YO1n1

Score
10/10
xworm

Malware Config

Extracted

Family

xworm

Version

5.0

C2

94.156.8.132:7000

Mutex

jUSkNbW8RCLyBnb3

Attributes
  • Install_directory

    %LocalAppData%

  • install_file

    svchost.exe

aes.plain

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm family
    xworm
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • svchost.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections