Overview

overview

10

Static

static

10

мая.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    мая.exe

  • Size

    201KB

  • MD5

    fbbc65ed3c396dde53930fdf5b2d9c52

  • SHA1

    13d08f28ee2fa7af9459070c7e56616f7eab8cfc

  • SHA256

    6e323dfc9e8193c1c89bb362167d41f32f7bdba2bc7d216ad1582a4533ce573d

  • SHA512

    f71f72f4388d5f65383cb1a8aafad9e5aaf831beedfe2de7c00b9658c1d3780e8aea2b6c05c6ce8c01cb86965e480772add2f5cc29b90b7c72d2fa82f9eb1386

  • SSDEEP

    3072:dDkoomr1cObj6xO14O5G63BaQaM4XdwQKDlI7i7qkVyHXG8PKd25lZte4:dDMmBcOb8QuSBaZM4MaOpVy3G462be

Score
10/10
xworm

Malware Config

Extracted

Family

xworm

C2

185.223.113.210:8850

192.168.0.1:8850

127.0.0.1:8850

localhost:8850

192.168.0.13:8850

programme-at.gl.at.ply.gg:8850

147.185.221.22:8850
Attributes
  • Install_directory

    %AppData%

  • install_file

    svchost.exe

  • telegram

    https://api.telegram.org/bot7171802829:AAFa8lKViQaI74QIapY_xrPT5tFR5X3bktY/sendMessage?chat_id=6555026497

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm family
    xworm
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • мая.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections