Overview

overview

10

Static

static

10

cali_fn.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cali_fn.exe

  • Size

    65KB

  • MD5

    840a5dcf652ee808112c6e89afb0dd65

  • SHA1

    c5a6a6e24bec6814fa63f84cd9f8f4bb9dda087a

  • SHA256

    f234859bf20424dfea9addd6011f6ec084c15ea8a381f65288ae2ec8280b4e27

  • SHA512

    5fc9ee0788577b474fb7110fd5aca475d0b9d96efec3e5948bde87fec26cee0a845cee0a7176b61672300483f5f3b13eb9ef475407848a057ff5474d1467c81f

  • SSDEEP

    1536:f3mOT6XUVJM0TMOemqeno0CbpUDkOFzzmBOAR88yRE:ffTVRMD0nobpb4zoOAC1E

Score
10/10
xworm

Malware Config

Extracted

Family

xworm

C2

147.185.221.22:47930

127.0.0.1:47930
Attributes
  • Install_directory

    %AppData%

  • install_file

    Runtime Broker.exe

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm family
    xworm
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • cali_fn.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections