General

  • Target

    iproxy.rar

  • Size

    221KB

  • MD5

    c2a8475ba6e744eceb1f5377d398ff7c

  • SHA1

    211dd4c7a5331fc1420685ba212e34aa09b6d7a4

  • SHA256

    03a9fd95e605885c1d938fbb08ca496dd0b22394f59a786b44bb4e2c65089927

  • SHA512

    b199312bac4b5508636b2d4f20677432e442f2c151bf4e88faf5ef5cf0de826e721d84d604a1997030d3932dcfdce13a75fb934ea8688027a4a0398a57a9706c

  • SSDEEP

    6144:f5J9k6Qyua1FrKs6vKDj35Xu+xaT0rRReJs:x8abrK0jJe+xaT0r6s

Score
10/10

Malware Config

Extracted

Family

xworm

C2

147.185.221.22:62812

Attributes
  • Install_directory

    %AppData%

  • install_file

    ipban_remover_cssv34.exe

Extracted

Family

lumma

Signatures

  • Detect Xworm Payload 1 IoCs
  • Lumma family
  • Xworm family
  • Unsigned PE 2 IoCs

    Checks for missing Authenticode signature.

Files

  • iproxy.rar
    .rar
  • iproxy.bin
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • iproxy.exe
    .exe windows:6 windows x86 arch:x86

    32763fe918c768f0610038380cd00f60


    Headers

    Imports

    Exports

    Sections

  • proxy.txt