General
-
Target
30cd99a605d46a04df4d56c0b5b287f64e5f53ce43f9da79245a0c465d498ff8.exe
-
Size
35KB
-
MD5
22ad4420fc6bfd87dc083d5ae09b166e
-
SHA1
59cfb0a7a73ab51a6ba4ff0a82503feada3b3d9a
-
SHA256
30cd99a605d46a04df4d56c0b5b287f64e5f53ce43f9da79245a0c465d498ff8
-
SHA512
10a90f7736149554da4094cb347974fd4a29f618119bd01eb955f16e7661b3cbde7081c560e3f50a002bdc5b4d61e962d991e945882bc5e92f1ee8ee38f75771
-
SSDEEP
384:5gg9j00WbqxAMTayV5N+5maFZZL3CUpJm3/KNm080VgtFMAmNLToZw/RZCvK9Ik4:3B4QBTOl3C53CNUVFQ9iq7OMhTurlX
Score
10/10
Malware Config
Extracted
Family
xworm
Version
3.1
C2
doz6060xwo.duckdns.org:6060
Mutex
s8XAq9WkJMBtraSJ
Attributes
-
Install_directory
%AppData%
-
install_file
USB.exe
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
-
Detects Windows executables referencing non-Windows User-Agents 1 IoCs
-
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
30cd99a605d46a04df4d56c0b5b287f64e5f53ce43f9da79245a0c465d498ff8.exe
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections