General
-
Target
lol.exe
-
Size
34KB
-
MD5
4d42d6e6cd742d5ceb230cc03bd68ddb
-
SHA1
febe5e6fdb4cf23e32015bd8c51e6c8af9e95d05
-
SHA256
ce410544a8c50321cbb0fa4fa0f903ec927f4d6d173d09bc37aa54ad5c7ad49e
-
SHA512
f1bcd03c98ad29234cf0f1adb805083bd77e718b0eeb9f0806b9a4eb6265356e1ef3967b45f4f5b6e918a06db9a5d78a26724421dedb03e70201a7b261c7cc42
-
SSDEEP
384:tVxu9qBOae6oK/I7Z9plUzO7LMecZ9CZpbW3tXe3qXR8pkFXBLTIZwYGzcvw9IkF:rxuaUJRnpcZ96pbWx9FV9jhNOjhd/4H
Score
10/10
Malware Config
Extracted
Family
xworm
Version
5.0
C2
lefferek-42016.portmap.host:61672
budget-compiled.gl.at.ply.gg:61672
Mutex
ANnWPu8LZzU6MzOM
Attributes
-
Install_directory
%AppData%
-
install_file
DiscordClient.exe
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
lol.exe
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections