Overview

overview

10

Static

static

10

pook.exe

windows7-x64

10

pook.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    pook.exe

  • Size

    61KB

  • MD5

    6dd93da1113a0a8a77779a41c94ee31f

  • SHA1

    37633829faeb7726f18e64410a33599844fdf5af

  • SHA256

    d6f3ada0757242b2c66ba728a803d57f06b374bb2f70eac0d4ce40eb2d6ee0a9

  • SHA512

    a82d4e5965f95298ed19fe33d90b96acf857756b0c736d2f36ba48c2a6a193703baa9a0ae4abeaa16063cbb80e6f35e273291c17b6db120cdcaba19fb813f7d5

  • SSDEEP

    1536:FJJ63gHBOFph/jNFa3Gsbmp4HTVBFV6RsGOmVce:HJ63QKL/a5bmeLFQ3OmVce

Score
10/10
xworm

Malware Config

Extracted

Family

xworm

C2

main-although.gl.at.ply.gg:30970

Attributes
  • Install_directory

    %AppData%

  • install_file

    XClient.exe

  • telegram

    https://api.telegram.org/bot7208700451:AAHHz5xWybJ91pH6F9vJRw8dcMEBlRiBXKs/sendMessage?chat_id=6131620354

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm family
    xworm
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • pook.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections