Overview

overview

10

Static

static

10

1220.exe

windows7-x64

10

1220.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1220.exe

  • Size

    33KB

  • MD5

    746577f77d116be5548fe36ecf69653e

  • SHA1

    ff8b367092c14c31b3f11e633248d0913f65a94f

  • SHA256

    fdc004f1ae0e35bb9876ef0764d45841551f06cdb20a9f749ef5e9e3f8ec0215

  • SHA512

    8534745bc6e0fcdaf10d2a7e557ded0a0f9053dd238e2534989fa10894aa9ce1370dadc4515f0696f49454e30495b95a11138e9e203b85a301b20305a4f06f4a

  • SSDEEP

    384:kkmaqH1PJUt8bOoTz5LzNz3Tm2eaFOzFzRApkFTBLTsOZwpGd2v99IkuisHfYVFS:ZiHDD5FZz3Tw4OFzVFE9jefKOjhwbm

Score
10/10
xworm

Malware Config

Extracted

Family

xworm

Version

5.0

C2

wafflemafia.top:1220

honesty24.duckdns.org:1220

havertz.duckdns.org:1220

freedom24.duckdns.org:1220
Mutex

sNb0G0pWm5AOvhqF

Attributes
  • install_file

    USB.exe

aes.plain

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm family
    xworm
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 1220.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections