General
-
Target
why-so-serious.exe
-
Size
34KB
-
MD5
075e5dfc2e2877d810d9eb361d0dfe33
-
SHA1
3b4c8856d50de13242bbfd25324c16b6c6500d8d
-
SHA256
a0756ab29accc2be2e7635acc8940e3220cd7dd9eb45885e9c8c84c820af7218
-
SHA512
c0f6426a3acd4d2283724b3f86426efb91fd9f4d2dcb8b5dcc714a30652802277d46784bafda0151954101ac3c49aaba4acd33e9ef90218f8d3952573fc12429
-
SSDEEP
384:gSyXlquOae6oKoBmoDnnGvBLmlVCwvHixdTD2VR8pkFTBLTIZwYGDcvw9Ikuistt:XyXiBDAtYVC4CaV9FZ9jAPOjhj/4/
Score
10/10
Malware Config
Extracted
Family
xworm
Version
5.0
C2
lefferek-42016.portmap.host:61672
budget-compiled.gl.at.ply.gg:61672
Mutex
KvL0ZeqSklQx7juN
Attributes
-
Install_directory
%AppData%
-
install_file
DiscordClient.exe
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
why-so-serious.exe
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections