General
-
Target
bro wtf.exe
-
Size
54KB
-
MD5
a02c5e4bd6c0251fd888ad72d0a9fd3f
-
SHA1
4efdaa0e9b8832306d19d90b1ccca65a7ddc8750
-
SHA256
0490ba3773fed7d43bc0286755a20a174b2b40d0008d6657229e1a92c631c21e
-
SHA512
6b6c876f5c67d32a700063e2493b18e5c8082ba2f53dc080576fe4cc8904181e025b555f7b7d0dd7b6a28c83561f2945c6b9b878cbafdd152433359533d8cb8b
-
SSDEEP
768:8IulzjLvthS+q1gFEWKr1K58nUdE3Wp8wVl8Su0kbKf6KAylN8Il/OaOhWnrUI:FAfe1keKNO3WdL80kb06KfNLBOaOowI
Score
10/10
Malware Config
Extracted
Family
xworm
C2
Phnxss-27839.portmap.host:27839
Attributes
-
Install_directory
%Userprofile%
-
install_file
Windows Security Notification.exe
-
telegram
https://api.telegram.org/bot7358011073:AAGdUduenjLHLDVW3OYWkXisH68mtspgA2Y/sendMessage?chat_id=6860608587
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
bro wtf.exe
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections