Overview

overview

10

Static

static

10

System32.exe

windows7-x64

10

System32.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    System32.exe

  • Size

    73KB

  • MD5

    db85ba4410e7f75924ae9b7985875203

  • SHA1

    d38c7fdaab9cab8c2d92f459301097e09a05c960

  • SHA256

    6721d9a40d2fecf4c74d5cf326ffe4a709b5fd8b75ce188ee5567f1d803a18ab

  • SHA512

    63a2856be3b1d8565badccd931fb98a160d654b447e1365140648b8fd269c71afc6788875e6c1bf0a8899a88fb786545e7cacd5ddc1f004484c42abd0416dfd6

  • SSDEEP

    1536:3ofoesNaF+O41JIlLQbl4sUf7KFBuH6DrDO9Bfy8s9S:YgO44abl4WPObfy8yS

Score
10/10
xworm

Malware Config

Extracted

Family

xworm

C2

https://pastebin.com/raw/PG3MaVGP:123456789

Attributes
  • Install_directory

    %Temp%

  • install_file

    dllhost.exe

  • pastebin_url

    https://pastebin.com/raw/PG3MaVGP

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm family
    xworm
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • System32.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections