Overview

overview

10

Static

static

10

sample.zip

windows7-x64

1

sample.zip

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    sample.zip

  • Size

    356KB

  • MD5

    ff09d3899b6864d91275010db132380b

  • SHA1

    35f7af67c95898ad2bf23b0e03efa4ff44012316

  • SHA256

    b003445bff3c74372984627698d00b1210ef6846cd94b1a0c3eaec78f48de0e3

  • SHA512

    7ddf184563125574194509900230aed67216c401c9777efc326e51403bafa55ca6c40807215f2fb4491b81725ec6d819d453402f69f49bae4fed16cac6b55f82

  • SSDEEP

    6144:pqXFIbKXyoc5NwK9RscAVGwNvb/Trn6yj14y0nj7IUto8u9iEOv7J1B47m7oQ/ps:p0FZcfweRscbwN7TrnV1Ij7f1YiEOVLW

Score
10/10
xworm

Malware Config

Extracted

Family

xworm

C2

https://pastebin.com/raw/L3Xphr0J:201770

Attributes
  • install_file

    Prefetch Manager.exe

  • pastebin_url

    https://pastebin.com/raw/L3Xphr0J

Extracted

Family

xworm

Version

5.0

C2

https://pastebin.com/raw/L3Xphr0J:201770

Mutex

6v4WYaRvuLlBuDxn

Attributes
  • install_file

    Prefetch Manager.exe

  • pastebin_url

    https://pastebin.com/raw/L3Xphr0J

aes.plain

Signatures

  • Detect Xworm Payload 2 IoCs
  • Xworm family
    xworm
  • Unsigned PE 3 IoCs

    Checks for missing Authenticode signature.

Files

  • sample.zip
    .zip
  • sample/ForceAdmin.exe
    .exe windows:4 windows x64 arch:x64


    Headers

    Sections

  • sample/sample.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • sample/sample2.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections