General

  • Target

    3451c30e61ca3e7894c37f843249f0b202aa96d9fabd40cca08d70c10b650ebe.zip

  • Size

    779KB

  • MD5

    81062e899f2d58ae78dc74e3ad1c7d0f

  • SHA1

    30e26b3ec28530f7f35accc7e8a6e6838f3c0172

  • SHA256

    3451c30e61ca3e7894c37f843249f0b202aa96d9fabd40cca08d70c10b650ebe

  • SHA512

    30c4cc8535054ed7da2cd100ff5a8d03879c44e4755573b442bbe416a695a5598a1f20c6a5d7cb0f6374b0b710527a51799ca110ef41d6e4e54d042c0bbc21a5

  • SSDEEP

    12288:ebt6BwiS/BMPfgCc2UDC5mykizg+6PGgySVGhSVr2kzYvfr4K2FFHrvYcpJ:0t6yimBMPfD9UfWw8SOKStkTLAiJ

Score
10/10

Malware Config

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm family
  • Unsigned PE 3 IoCs

    Checks for missing Authenticode signature.

Files

  • 3451c30e61ca3e7894c37f843249f0b202aa96d9fabd40cca08d70c10b650ebe.zip
    .zip
  • main-main/RuntimeBroker.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • main-main/msconfig.txt
  • main-main/td.exe
    .exe windows:4 windows x64 arch:x64


    Headers

    Sections

  • main-main/tdservices.exe
    .exe windows:6 windows x64 arch:x64

    6f181bbb9b68fced5b0aaae00cf24483


    Headers

    Imports

    Sections