Static

static

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    solara.exe

  • Size

    70KB

  • MD5

    a5386567ae61803a325c3ba97971ca8d

  • SHA1

    c6b3a822187e468ddca82be0521619d8d115c900

  • SHA256

    33b106529f7dda01070a24dfc433220c4a05d442e3cde876e91088b263b2bb62

  • SHA512

    f2e4aed93b86549d6f20ee91ea47bfc0bf58a32b703213dd02186c8ecc119223529230cd959ab41fd8853efabbee604b3ccfe862950af21b4a14c33d03a229d1

  • SSDEEP

    1536:ERb2bLu8Lgdn6IwDq+k2BqAbXjSSt6AmOh3/95q:Eb2bLu8bIsq+mAbXxXmOh3/e

Score
10/10
xworm

Malware Config

Extracted

Family

xworm

C2

127.0.0.1:4570

detailed-programming.gl.at.ply.gg:4570
Attributes
  • Install_directory

    %ProgramData%

  • install_file

    system.exe

  • telegram

    https://api.telegram.org/bot7393663220:AAEX8TwRx5_ZYBB3p82LVgycXEx7HdlFl3w/sendMessage?chat_id=7667501293

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm family
    xworm
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • solara.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections