General
-
Target
tmpkpefjqx7
-
Size
37KB
-
MD5
642ad3e40b11c9623d3988f68818d7d5
-
SHA1
0c27e45d810f4c97be82b65dda943cdf5f2bc66f
-
SHA256
ccbdda883a1ab8170c280680e9f7af7e4001cec36f68773d0a9327991aaa0032
-
SHA512
f92a5939aabcbcc175a857399636a4f0b01a0aa8003fb3985c1d8d1f4173a44cc5a00318c8903b63e27af461844eec6115fc6e59d9bc16d289565adad72b7361
-
SSDEEP
768:K111JaCyLgJwZwPJiVEW16Fp9HgdOMhm3OgdP:Kf3aCgdIcEDFp9H8OMsDP
Score
10/10
Malware Config
Extracted
Family
xworm
Version
5.0
C2
104.243.32.185:7000
Mutex
nYYCvxHXYQfAQcPE
Attributes
-
install_file
USB.exe
-
telegram
https://api.telegram.org/bot5112782641:AAEVhDgUqm4o4Ygqtq2_C3RuM_QdhcPC7is/sendMessage?chat_id=985608946
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
tmpkpefjqx7
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections