General
-
Target
Способ для робуксов.exe
-
Size
155KB
-
Sample
240531-xzkhwaab5v
-
MD5
2c4a39f9ac5bd64866032c0bd7faa9c5
-
SHA1
ed6fdf71f0d0fedf29f6b78a207f5710426da78f
-
SHA256
f38da3e39db37247e99bcbebfcd72a7ccc5811bbb1a7aef61ee310d15f7b1564
-
SHA512
851127dd54647723eac9e61da7a85094b0b554fe2ef2b2885d89eb36807cbb7daf1ea2193d2f0b000131bcd4dc66ec6e2c16812e6d5a85ad987e35ae4ba0e05f
-
SSDEEP
1536:3bRPzxY+ltJ7Fg9Bh8OMB4jls3WGkoe6Us89T8r9AtnertLFH:3bRPG+hFg9BWOM+a3v7EskT8rmtIhH
Malware Config
Extracted
xworm
5.0
glass-coffee.gl.at.ply.gg:5417
NXMplQ2VmD02KTh5
-
install_file
USB.exe
-
telegram
https://api.telegram.org/bot7244696222:AAHqbV7Klrbtt5G5MocnpyydNFGt1mksjWg/sendMessage?chat_id=5854542114
Targets
-
-
Target
Способ для робуксов.exe
-
Size
155KB
-
MD5
2c4a39f9ac5bd64866032c0bd7faa9c5
-
SHA1
ed6fdf71f0d0fedf29f6b78a207f5710426da78f
-
SHA256
f38da3e39db37247e99bcbebfcd72a7ccc5811bbb1a7aef61ee310d15f7b1564
-
SHA512
851127dd54647723eac9e61da7a85094b0b554fe2ef2b2885d89eb36807cbb7daf1ea2193d2f0b000131bcd4dc66ec6e2c16812e6d5a85ad987e35ae4ba0e05f
-
SSDEEP
1536:3bRPzxY+ltJ7Fg9Bh8OMB4jls3WGkoe6Us89T8r9AtnertLFH:3bRPG+hFg9BWOM+a3v7EskT8rmtIhH
-
Detect Xworm Payload
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-