Overview

overview

10

Static

static

10

scvhost.exe

windows7-x64

10

scvhost.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    scvhost.exe

  • Size

    42KB

  • MD5

    4171f38c413ee527c699d6a124738bec

  • SHA1

    65db2ecf73416a1c75107ed0bdb40f9072033167

  • SHA256

    e1b83b2921ffbccb583adc624492872331f6e029c35c880b24940a4d8526c7dd

  • SHA512

    4f0752f5fa6b6b98948d5770b69501e8c5a5edac1cc25ef49ac904428fb178199d53aef92aa93411d88df60c3270188710f29a87e2e599b307bbfde943f2d0e7

  • SSDEEP

    768:eEGcr3BbT4UAd29etN8cuGgFFRPy9dN6TO5hiW5y:xTrR/RI9IF09dN6TO5kh

Score
10/10
xworm

Malware Config

Extracted

Family

xworm

Version

5.0

C2

192.168.0.3:3389

184.190.169.22:3389

192.168.0.8:3389

192.168.0.7:3389
Mutex

wb34QNtoOY5wHRBe

Attributes
  • Install_directory

    %ProgramData%

  • install_file

    Microsoft OneDrive.exe

aes.plain

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm family
    xworm
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • scvhost.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections