Overview

overview

10

Static

static

10

0defd5d83a...a7.exe

windows7-x64

10

0defd5d83a...a7.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    0defd5d83a647817334ac370af10522d15c30f04cbb15d2af9c2a23e321502a7

  • Size

    103KB

  • MD5

    bc5643c3bf891add168a6d6dccde16b9

  • SHA1

    619d318243cefc55a7fd40b52abca200ac788acd

  • SHA256

    0defd5d83a647817334ac370af10522d15c30f04cbb15d2af9c2a23e321502a7

  • SHA512

    b85f7301b743733f72653c7a8f19832a9347eb4145690aa80af58369624e772cee53fbb8bfa71c18bf3e0c46a8f6dc7b21a1c7aaffe4c54779e8a3102b34dd40

  • SSDEEP

    3072:PWwx4VKu0ykb9096OW1LZlv0tFDoB0Li9a:PWwx5PbmhFMBy

Score
10/10
xworm

Malware Config

Extracted

Family

xworm

C2

127.0.0.1:19706

actually-saw.gl.at.ply.gg:19706
Attributes
  • Install_directory

    %AppData%

  • install_file

    QuestClient.exe

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm family
    xworm
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 0defd5d83a647817334ac370af10522d15c30f04cbb15d2af9c2a23e321502a7
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections