Overview

overview

10

Static

static

10

PowerShell.exe

windows7-x64

10

PowerShell.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PowerShell.exe

  • Size

    60KB

  • MD5

    d24bcb7920914bec34714cf58f97fcea

  • SHA1

    65dc35142e66cdb39f05378012ca286c102d9f5b

  • SHA256

    764332b42c33e758a4c522990c2822d1fd4c4ed0e5606af510567c4fd317c545

  • SHA512

    82073ef790cad4f03c109b371e324e84907005d8c5a9b97f2793c976f6df0bb28fe3a82044f94917695d19db3d57d302c67b17295247c9303ab2f3f749afbd2e

  • SSDEEP

    1536:K9peiD0OENwpAXD1YkbLTTHx6hhmXyOpWJh:gXD0nXDikbLHHx6hh4yOpWJh

Score
10/10
xworm

Malware Config

Extracted

Family

xworm

C2

week-dictionary.gl.at.ply.gg:12466

Attributes
  • Install_directory

    %AppData%

  • install_file

    PowerShell.exe

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm family
    xworm
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • PowerShell.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections