Overview

overview

10

Static

static

10

Nursultan.exe

windows7-x64

10

Nursultan.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Crack.rar

  • Size

    40KB

  • MD5

    f98a65665a34388e82c0cf3c3c2cc7a4

  • SHA1

    3d729346f6d8ee8dea0cc1f4d2373b0720147946

  • SHA256

    c1bb62643465be92b8fec645004bacf1f7ea0709f60c116a153f10f5e1856cea

  • SHA512

    8287035380f48e246ea8bbedaca943a498b7ca25f22d7d1c4a13fa56cd51e505b9135403ea67834776f574e22d159c7c4677df97b9b8e702535cda3114d5b4ac

  • SSDEEP

    768:1siTtuMle9Elt6hVfibisADUi025JENBWjhdQDBNmAgJh7tMHG6zfO1R:XTtuwwSt6hVfibVAP5eNBKzOD4P7tMby

Score
10/10
xworm

Malware Config

Extracted

Family

xworm

C2

various-significance.gl.at.ply.gg:43319

Attributes
  • Install_directory

    %ProgramData%

  • install_file

    Winrar.exe

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm family
    xworm
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • Crack.rar
    .rar

    Password: CRACK

  • Nursultan.exe
    .exe windows:4 windows x86 arch:x86

    Password: CRACK

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections