General

  • Target

    ShellExperience.exe

  • Size

    94KB

  • MD5

    2bf7a8f812b079dc8319a76d67eb88fa

  • SHA1

    84eb63daa0bb7c1052da5d8c2dd2b82cf2be2b64

  • SHA256

    3150d0efff068e6f2963891667085ff0b7e841b2208e0bddb368c05246bb8829

  • SHA512

    6aed3c34d4f6991755432aa3c5b8f11ccaba5796118ffe64d2d912d1132ab1cd6250be76536a1640332cb0f8d5d56406683443722dd2f499973025929bf308ba

  • SSDEEP

    1536:q2bxcRngtUyosQVElr6kqmEyCB9bcqtyn/IjWuUHNNPROBDB4u/v7IVn1ksZu3J:F1UngGyoRV22kqm89bfty/znNJROxB4u

Score
10/10

Malware Config

Extracted

Family

xworm

C2

proxey.publicvm.com:1003

Attributes
  • Install_directory

    %ProgramData%

  • install_file

    ShellExperience.exe

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • ShellExperience.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections