Overview

overview

10

Static

static

10

Script.exe

windows10-1703-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    Script.rar

  • Size

    20KB

  • MD5

    c5d2313c3c2555a5b75f7b351d4283a2

  • SHA1

    f43fe3052a50764af73232756df3f4dd1cc6fffd

  • SHA256

    5c353c33f2ab1e95ef7593b8c1d74c1ca80d385fc5fd7a13223b0274d902810e

  • SHA512

    5fdbd85dfbdbe1202978d5fba5a50fafdf104ccff73e1d85e4434aaa6eec5a7232b1711c84295b01916f4845e5b2350ab517e53cf36dcb4a5cece3b92a088472

  • SSDEEP

    384:DPEb+w+XvjAYjVDrN/ou4JFWKJzYuMYNonVyel6v2rJUQJPH4w8uNIqqsfM5:DsbcXv9Zf5ou4JIKJzfMY+Vy5vWrJPHC

Score
10/10
xworm

Malware Config

Extracted

Family

xworm

Version

5.0

C2

6.tcp.eu.ngrok.io:15230

Mutex

c8oNTztoskImoqke

Attributes
  • Install_directory

    %AppData%

  • install_file

    XClient.exe

aes.plain

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm family
    xworm
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • Script.rar
    .rar
  • Script.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections