General
-
Target
3488-9836-0x0000000000180000-0x0000000000192000-memory.dmp
-
Size
72KB
-
MD5
9bd3a524a33f40d9f541c142cd2a3bb2
-
SHA1
1d00152c85ae7a63fa8595343e8fe458c1b01322
-
SHA256
9fe58111196c0c7969eeb52b32eb9923680d930abf3ca18cef950d7096d94ea7
-
SHA512
1e6eb05cfc4f8e29b2eff50b5202aadffe2c91127834ac3e13499ed7168e0c642d5e95d14d4735086b7cee3298be7a0e07fdd84f2becf36b4ea574eaec2e50ea
-
SSDEEP
768:fNrD/wRwTAoWa4lqzTRvjvxsl6UFRP59xsOuhtOq:f5jMRIhSFH9xsOuLn
Score
10/10
Malware Config
Extracted
Family
xworm
Version
5.0
C2
178.215.236.251:717
Mutex
0AVeWj1eTvHM3Un2
Attributes
-
Install_directory
%AppData%
-
install_file
XClient.exe
-
telegram
https://api.telegram.org/bot5987023205:AAFlvwKv3zD3wQ2CQAewIB6uU95uBQ25ip0/sendMessage?chat_id=5202962680
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
3488-9836-0x0000000000180000-0x0000000000192000-memory.dmp
Headers
Sections