Overview

overview

10

Static

static

10

12345.exe

windows10-2004-x64

10

12345.exe

windows10-1703-x64

10

12345.exe

windows10-2004-x64

10

12345.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    12345.exe

  • Size

    150KB

  • MD5

    d13d782145b117b613e280154be13766

  • SHA1

    5883c7e38a4e691a91a39fe85ba0328f768ba058

  • SHA256

    143c7c66e4b29fc6512c5f40cfab62db2eeb807712cc0653cc1b5e25c1737143

  • SHA512

    94eac13bad566c4ddeb598ab551fcce326318325a2f9794b66945f7d5169fab04f6080547af3ff89c17ddcb9c954ca263e6b8829f98f436b3866cae2747e0c97

  • SSDEEP

    3072:80DOFU9SUOj74NpVq8BxFRzaqF+o2GQJ7/JzqVfGv0:kU9AgVqwlL

Score
10/10
xworm

Malware Config

Extracted

Family

xworm

Version

5.0

C2

https://pastebin.com/raw/U4NAmTv6:3222

Mutex

sltPbB1L3ZONereC

Attributes
  • Install_directory

    %AppData%

  • install_file

    svhost.exe

  • pastebin_url

    https://pastebin.com/raw/U4NAmTv6

aes.plain

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm family
    xworm
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 12345.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections