Overview

overview

10

Static

static

10

cf0793dd79...63.exe

windows7-x64

10

cf0793dd79...63.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cf0793dd79285e039745f37cae227a8298191075cfb57672d7d36e0cdfef0d63

  • Size

    75KB

  • MD5

    2c642c51cfc83fd4866a05d6a6b63be9

  • SHA1

    0b174996038b8326d7878971f08efd5a4c31aa67

  • SHA256

    cf0793dd79285e039745f37cae227a8298191075cfb57672d7d36e0cdfef0d63

  • SHA512

    4ac8c5e3146b9ac27e65e73b2c62bda61336d2821997464363b53beb5287a8a590c4b0a545b5c5f165f36a57ed1d30345a3e49ce8d9c083c8bc7ebf118d5df6b

  • SSDEEP

    1536:shfgMPrf/YopXX7TSeRuyhFq9HdBFbrDBYNiPR6KOijSe3gK:shfHP7PXrTSrWFq9HVbrqEPBOijS5K

Score
10/10
xworm

Malware Config

Extracted

Family

xworm

C2

127.0.0.1:1016

Attributes
  • Install_directory

    %AppData%

  • install_file

    svchost-service.exe

  • telegram

    https://api.telegram.org/bot7299609726:AAF2JCjFJR7TmN4hpow1L_o0VYVcxdRdbkA

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm family
    xworm
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • cf0793dd79285e039745f37cae227a8298191075cfb57672d7d36e0cdfef0d63
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections