General
-
Target
Onioncrack.exe
-
Size
206KB
-
MD5
166cd568396c15d96cc171fd9662c430
-
SHA1
ae4c4d7f9d7d823fead036878bc832e84ce8cf8e
-
SHA256
ef1eeafff3219798e7810a3653a680104d82e731d4e2cc9e10c2c0425a6afcd8
-
SHA512
aba1aced15e826b970b463e551882c13d5c22f6d848c527e577d1724a48ef0a8cd46969e74a4ca7826ddac605f1a1383fa900db8309a847107f312d347c62905
-
SSDEEP
3072:IBkaQl7LFc90cOMn8SKfbzxcwg7es6/Vsb8VKTup49oJMfF/H9N3Ky9NzLna:IYdc9LUhcX7elbKTuq9bfF/H9d9n
Score
10/10
Malware Config
Extracted
Family
xworm
Version
5.0
C2
glass-coffee.gl.at.ply.gg:5417
Mutex
uvV9IoGdqsyWtzwq
Attributes
-
Install_directory
%AppData%
-
install_file
XClient.exe
-
telegram
https://api.telegram.org/bot7244696222:AAHqbV7Klrbtt5G5MocnpyydNFGt1mksjWg/sendMessage?chat_id=5854542114
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
Onioncrack.exe
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections