Resubmissions

13-07-2024 23:41

240713-3pr3vstcrb 10

General

  • Target

    Discord Tool v.7.7.exe

  • Size

    65KB

  • MD5

    5ff4a7e0fefe94b3bbf86f2137577ff2

  • SHA1

    67d9e82ef85881813228e902fd7880e0ceba20b9

  • SHA256

    a562d44e4bf6ec4f8a15c420bc3343f56011b2b454862869e01471075cba1a7e

  • SHA512

    05edf0d3bc2da186f6a159ef6e5c6f0456fc0979e188c8e8cb62799e0c663515dd9d4aaf631ac8f7830934a618e6eca5fd94e0e1d39d14ee9fbf68e97e8319a4

  • SSDEEP

    768:kRwwGkRrFpObTMFIiVZTKb9hFrTbpkLZ9WBf6Owg5+OWhXBZ5/HA:kRxGW5kbTqgTbpm9g6jk+OWRxHA

Score
10/10

Malware Config

Extracted

Family

xworm

C2

original-preston.gl.at.ply.gg:51307

Attributes
  • Install_directory

    %AppData%

  • install_file

    XClient.exe

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • Discord Tool v.7.7.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections