General
-
Target
SolaraPremium_free (123).zip
-
Size
45KB
-
MD5
60985be343d8e9dc726228108972a749
-
SHA1
425b14188341ad773debb152daceca9325445e48
-
SHA256
738f293e69017888aa0720f79599e9a5818f879629fb7409619c4a2c1bcc4997
-
SHA512
a6036234e561110ee81c1cf0fa0f42c403b5c0715460b55c329c815b75e637cee706c438ef37d939cc3962dfbd03477fb0cb6e7cecce5cc374b5fda5103ad3ff
-
SSDEEP
768:1wV0AYHTZhBQnh9LXHt/n0NutSK4E1V53btIGUefoMJf/PowtQkc9OT/PEDdwa6F:1A0AiZHczHl04IGPxJuMp/mkcqE+aU
Score
10/10
Malware Config
Extracted
Family
xworm
C2
office-franklin.gl.at.ply.gg:24536
Attributes
-
Install_directory
%AppData%
-
install_file
USB.exe
-
telegram
https://api.telegram.org/bot6334490377:AAH-lXvBkXB8m1zAjFxTRAd4ZbTYva3fvLY/sendMessage?chat_id=5519921687
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
SolaraPremium_free (123).zip
Password: 123
-
SolaraPremium_free.exe
Password: 123
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections