Overview

overview

10

Static

static

10

GalaxySwapper.exe

windows7-x64

10

GalaxySwapper.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    GalaxySwapper.exe

  • Size

    169KB

  • MD5

    465e6a6662415e49b65f59cb8ded03f1

  • SHA1

    082cb2d0e56c39c5c63e288865d44636dca3ad31

  • SHA256

    b04805a93e29a1417cb67150005ef27cc743f2ecbe0ef221257a16c3f0521977

  • SHA512

    46d966abf3ee8d219b80975c0cb328329edda73139a4a1463bac68b2d0f42a499cea45ec73fc085026ffc2a3c864becc34ade7be48549222541fe51aa6735b4c

  • SSDEEP

    3072:WzMVVI0kbXX6ElevOO37vBz65/M6If+3Js+3JFkKeTnL:WztnbnwxBt25

Score
10/10
xworm

Malware Config

Extracted

Family

xworm

C2

agency-lottery.gl.at.ply.gg:21526

Attributes
  • Install_directory

    %AppData%

  • install_file

    startup.exe

  • telegram

    https://api.telegram.org/bot7375237961:AAFlPWXmEriRUUWDWeG1DeZifKaAFaWD10Q/sendMessage?chat_id=7534517325

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm family
    xworm
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • GalaxySwapper.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections