General
-
Target
2680-86-0x0000000000400000-0x0000000000430000-memory.dmp
-
Size
192KB
-
MD5
8b58a61e1d10d4e7ba3a76c34d251988
-
SHA1
280f66634d30202f4de4b5a84db4688f0c840c36
-
SHA256
c4bccdabcd58a57378bce8b11e72e8d94016e0ac88e9f874c22001397162ab49
-
SHA512
c72288af090a30382203b33bf6452f505dddccc8e4a6ee0d2f644ef4979d3f8bbca66498e33a52290f5582cc45dacbe1d9de74455a5ad6c9575c366c5bdc9c1f
-
SSDEEP
1536:R+Lc1ecvKtYBB8X6a1Ixtr+brErTHJTze6h9OxucEu:ocv4a8X6aUtr+brglzzOYr
Score
10/10
Malware Config
Extracted
Family
xworm
C2
mariona.duckdns.org:6666
Attributes
-
Install_directory
%AppData%
-
install_file
Windows Logon Application.exe
-
telegram
https://api.telegram.org/bot6791686693:AAEHz_lfi8kl2cBD04Pylygl3eK5SddtxII/sendMessage?chat_id=5702314606
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
2680-86-0x0000000000400000-0x0000000000430000-memory.dmp
Headers
Sections