Overview

overview

10

Static

static

10

14b1d8af72...c8.exe

windows7-x64

10

14b1d8af72...c8.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    14b1d8af7272d1c0d8dc18a5342ed0186a70e6b24610ba31026cb2532b5d37c8

  • Size

    70KB

  • MD5

    6696fb86111a6134ff4155621601a0b1

  • SHA1

    6d8d7965cecacd0e3ffdb4257425187a766af204

  • SHA256

    14b1d8af7272d1c0d8dc18a5342ed0186a70e6b24610ba31026cb2532b5d37c8

  • SHA512

    9293479180b8eca5149c1cf61a0a8ba2e88f137b62764e7a693abff67f0add71223b0352190cabd52b56a6f5ff79cec3234d63db8024d71d419472bcd65ee31b

  • SSDEEP

    1536:npwD0MwL3dtIC/5bL+obyJphc+JDu6Phdr5OalHcm14:nq0MwJ1byJ7c+fdr5Oal864

Score
10/10
xworm

Malware Config

Extracted

Family

xworm

C2

sell-motor.gl.at.ply.gg:4763

Attributes
  • Install_directory

    %AppData%

  • install_file

    winlogon.exe

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm family
    xworm
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 14b1d8af7272d1c0d8dc18a5342ed0186a70e6b24610ba31026cb2532b5d37c8
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections