Overview

overview

10

Static

static

10

final_payload.bin.exe

windows7-x64

10

final_payload.bin.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    final_payload.bin.exe

  • Size

    40KB

  • MD5

    596c6218ef6d522f31faa3e455ffc61a

  • SHA1

    87927a8da0bc7e2b6263a3b29a142e6395e0a871

  • SHA256

    7105d584cafc03a35bbae8956fa58360da5b330d07d214d6e53c6352fddfc8ec

  • SHA512

    bea6f97dcf1559ea321bbbeaa56a7f4e3ccda38e7a834ad2a3dc89443f699e1bc35df072a98fccebeb56c3aa6d5a260e31581a303790e5c98f4af34efbc54fd6

  • SSDEEP

    768:kVgv4GAQrXdIecduPD5LM66Fd9HgrozOMhCmQ+sdY:kK4GAQrXdMGO5Fd9HggOMrOY

Score
10/10
xworm

Malware Config

Extracted

Family

xworm

Version

5.0

C2

ethankush.duckdns.org:4545

Mutex

KNBmWlVSFglYt6jc

Attributes
  • install_file

    USB.exe

  • telegram

    https://api.telegram.org/bot7471402442:AAE-YsqOBFcwM0627WSWCFFKmIQpLhYfiBM/sendMessage?chat_id=1459921596

aes.plain

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm family
    xworm
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • final_payload.bin.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections