General
-
Target
svchost.exe
-
Size
41KB
-
MD5
6ea0adc5e5cb551c5087ba976e17656c
-
SHA1
dbe7e3b008e579d27f23453a3ee8efcae8a234ac
-
SHA256
dc76fed88d6938e78f4c1f26d986ab04849370d4fd52a922c4035257067ee1c9
-
SHA512
de9bd0fab46c5ac48c9a03202d2d2dbb6588b2520d43493b4233ad3a9bc9cbe14f24fd9bfecc632ba55dd6210bd9ea8c1510cd1dbd0177c4713f9a69fb81052a
-
SSDEEP
768:pod37NnVbmTXwu96SR9r0/dd48Bf6F5PD9O4t668OMhE3EO2h:pHXwuYqyI8BiFl9l868OMS7Y
Score
10/10
Malware Config
Extracted
Family
xworm
Version
5.0
C2
19.ip.gl.ply.gg:26909
Mutex
ys1Cyr0Q20V3fLLD
Attributes
-
Install_directory
%AppData%
-
install_file
svchost.exe
-
telegram
https://api.telegram.org/bot7470818768:AAEb9517MwYc6ADWJM3v8A0fACinKtlgU7w/sendMessage?chat_id=6521445724
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
svchost.exe
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections