Overview

overview

10

Static

static

10

screensaver.exe

windows7-x64

10

screensaver.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    screensaver.zip

  • Size

    18KB

  • MD5

    9b954071c00943b3154a2e0d1f1f9795

  • SHA1

    3e8e42e9b152981c13a1d6d0ba9a3c898dde6885

  • SHA256

    9de2cbafa58a144deba35a8cf5f137e45915f8beebb95beb08a50e533428e887

  • SHA512

    e36f6367c0da7207f01089a084e1b6b28ae30b27fd783545d8ab3bc850254781ef7bbbe2940ee8753dc349e8529c540ae729e6630085525f07e080aaa453d850

  • SSDEEP

    384:fBbBhbbsKdXasoL0haVkePxbJTWBOPEERER1OM3DaCPYSr8vp6:Z1BbsyX9oLB1PjC4EhR1OuDsSr46

Score
10/10
xworm

Malware Config

Extracted

Family

xworm

Version

5.0

C2

memorialwords.xyz:4444

Mutex

0FDfqtSCPc6omfwK

Attributes
  • Install_directory

    %AppData%

  • install_file

    Adobe\Reader\updater.exe

aes.plain

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm family
    xworm
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • screensaver.zip
    .zip

    Password: infected

  • screensaver.exe
    .exe windows:4 windows x86 arch:x86

    Password: infected

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections