General
-
Target
4c7afc71fc4625f06d4d6e736485ae4662bc8ddeba257f03f8ff9bd49d05b1eeN
-
Size
46KB
-
MD5
75c6e468e9a91fadec2aa37c0d4cb880
-
SHA1
0ab8d38a0338427761f991c14d6e5d6326ae3f06
-
SHA256
4c7afc71fc4625f06d4d6e736485ae4662bc8ddeba257f03f8ff9bd49d05b1ee
-
SHA512
6a7660ad9f34305d12f62d2b25ddbceda09e09c1abc6de510d7410834de1939e110e38202898d442b0200cb7a71be5ffdf5b8b7c69219fa3b768a5d0a8bc4bef
-
SSDEEP
768:OG38HC+bb433GkraQIBql1gFEPX9O+Xp68OuhVzjq6E7:OQ8HbC7leFO9D568OurGD7
Score
10/10
Malware Config
Extracted
Family
xworm
Version
5.0
C2
45.200.148.216:7000
Mutex
jaCpXTdipuAqxe1x
Attributes
-
Install_directory
%ProgramData%
-
install_file
csrss.exe
-
telegram
https://api.telegram.org/bot7599165338:AAEewD8UlsW6A5a5m2CBqKPN0NOcI0CI6MY/sendMessage?chat_id=6883464169
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
4c7afc71fc4625f06d4d6e736485ae4662bc8ddeba257f03f8ff9bd49d05b1eeN
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections