General
-
Target
RedTigerSetup.exe
-
Size
308KB
-
MD5
08bd9d8eadefed4a4b7323d0027de5b6
-
SHA1
e165b2a08c8fe165ab8623ad2f1897d67f426ce2
-
SHA256
0e7104024d8eda4017d891550c1bcc2f5dd9ed80e9ac996898e5cf82a8919a12
-
SHA512
108797ae485ef95640496fbca226af9185811c9e6d35d46925e66b7bab9ba1ec9c81142ac24d5a561bd603c2cb5f12c49e5a1510d33ffd5474085fda23e6c9cc
-
SSDEEP
3072:tMPMabg5GKQfjkHVOBpaIEzgmn8d0oX3XEH9eRrPEX+FzwEenQ1/8rEXKuFA9:tMlbIofIH37Z80qXEHwRzkEzfmoy
Score
10/10
Malware Config
Extracted
Family
xworm
C2
agency-lottery.gl.at.ply.gg:21526
Attributes
-
Install_directory
%AppData%
-
install_file
startup.exe
-
telegram
https://api.telegram.org/bot7319597697:AAHEbms2pAMZzB0yEpJIAUJdEfo9KHqsC4g/sendMessage?chat_id=7534517325
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
RedTigerSetup.exe
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections