Overview

overview

10

Static

static

10

1660-14-0x...ry.exe

windows7-x64

1660-14-0x...ry.exe

windows10-2004-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1660-14-0x0000000000400000-0x0000000000410000-memory.dmp

  • Size

    64KB

  • MD5

    c1aa18b799fd92347ac07294df0c8587

  • SHA1

    2a83b0bdcacff7d7c64ff8b0540aacf94d555c59

  • SHA256

    267ceaee211c52cf00a1133892eb08fe33dbec9d0201f930b06b0765bb6e09fd

  • SHA512

    2d55911ab8692dd710c4d876b8de991700bb74671b91129dfdbc78ab57cd1d2ba91dccc4a60e6661a8e1a5ea50a904709a34017ee7d166d29841fee244004086

  • SSDEEP

    768:WTcqY0dLjpzrTbHDM6tQy720TF69YBSOMh/t:WTcqRdLjNjHWC2MF69Y8OMJt

Score
10/10
xworm

Malware Config

Extracted

Family

xworm

Version

5.0

C2

173.205.83.196:3210

Mutex

jJqPmV7YRG8bldRA

Attributes
  • Install_directory

    %AppData%

  • install_file

    XClient.exe

aes.plain

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm family
    xworm
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 1660-14-0x0000000000400000-0x0000000000410000-memory.dmp
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections