General

  • Target

    656-198-0x00000000003A0000-0x00000000003AE000-memory.dmp

  • Size

    56KB

  • MD5

    2e131a3965ad9d6ff7c142781167794f

  • SHA1

    7c09f1fb820e788955eeef1bf90d109871ad958f

  • SHA256

    d98545647148e19484a2a7efd8b72f9dc95dfbe80623e020e0319a4683322917

  • SHA512

    3f5a4448699fb9563c5f8d89b9f757e6050e9eeb034dd4be366a1525777eb4adb7887c6aa82d0d0118a5d6b4ae812156fc582df9fcd8fc9347ac40b73c94b65f

  • SSDEEP

    768:EUa+vNshO8q8UoxVJt76bRVFr9jxKOjhTbB:7vN4df978DFr9jxKOjl1

Score
10/10

Malware Config

Extracted

Family

xworm

Version

5.0

C2

91.92.247.130:2423

Mutex

jNAItsLzlKCj7FUO

Attributes
  • install_file

    USB.exe

aes.plain

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 656-198-0x00000000003A0000-0x00000000003AE000-memory.dmp
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections