General

  • Target

    Expensive 3.0.exe

  • Size

    71KB

  • MD5

    4d8c67f116afed39d1a1638d1f60e82c

  • SHA1

    f7bde1231a237cd5bb663c729bee92bbdf20e46d

  • SHA256

    adba1f5dfc1e917467184dcc01cd67fe3e5dfafa5db03c52b4bb7894827fad79

  • SHA512

    9cc32e1dbe32d6f45f0c25782f55e0a62eb0cc78d426834cec9a91f209d2cc72fa7e1dc0995339a227b0f6124ac84602272aa1d71d0dfb6eea11328fe6415364

  • SSDEEP

    1536:FscQuSvo0znd8gyFRN2ibLC+bxGuTMcpoz6G4OufqN:FoPtzn+PNDbLC+bxGuTSF4Oufu

Score
10/10

Malware Config

Extracted

Family

xworm

C2

loss-winners.gl.at.ply.gg:61007:1567

Attributes
  • Install_directory

    %AppData%

  • install_file

    Expensive 3.1.exe

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • Expensive 3.0.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections