General

  • Target

    Nexus.exe

  • Size

    40KB

  • MD5

    0b677bbe363ea393d2a1152b9c9c67d7

  • SHA1

    956f8c498490c595df946763d486c9016839f1b8

  • SHA256

    960c31ec0fad0f80d726d3a91d9bbbc68c34c09a60f9381a87a589eee8814133

  • SHA512

    f24a1bb67caed2487f78be90ae728c8ed386e46ef0159c188d0b8b05e479731b5ccb1b298e8e00db0b5c8a5d145dca3d56435b95ce0099286150fa814aad11c8

  • SSDEEP

    768:36Pq4VSviT+oGQAyAqbA8K7tF5Pq9IUOMhY3/Rsq:gvSqT1HAzAVKxFk9IUOMepr

Score
10/10

Malware Config

Extracted

Family

xworm

Version

5.0

C2

85.203.4.69:1999

Mutex

nejvXraHvLYWkslH

Attributes
  • Install_directory

    %Userprofile%

  • install_file

    csrss.exe

aes.plain

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • Nexus.exe
    .exe windows:4 windows x86 arch:x86

    Password: @Bankty

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections