General
-
Target
2316-133-0x0000000000E10000-0x0000000000E28000-memory.dmp
-
Size
96KB
-
MD5
c9d4f8fba3b098ca9a4465c6f91ebe0b
-
SHA1
7f5c68430028460754614e908b74652f9c327f8d
-
SHA256
1036a20e1613a2487d83703f6b6fc0a2d6ad1ecd080165874cb130c06ea935f7
-
SHA512
7703c59e3cab1bff95b1a595bd67175dff89f41374cd8f135c091cfb35e95f86fd086e72bfa26173d65e3ba99632a645e84ad70a11a61e60b85cdd3337b0186b
-
SSDEEP
1536:BC7dCCRXek2ycziKLGIp78eax9xbMxioyAgDd+E6V186Oc8E2e+:87MKOHXBGVpxbIEAgRA1dOcYe+
Score
10/10
Malware Config
Extracted
Family
xworm
C2
87.120.112.33:8398
Attributes
-
Install_directory
%LocalAppData%
-
install_file
svchost.exe
-
telegram
https://api.telegram.org/bot6673004050:AAEcDfPnnGAswDvyrn9-bkOySVSnbPqLnBU/sendMessage?chat_id=1470436579
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
2316-133-0x0000000000E10000-0x0000000000E28000-memory.dmp
Headers
Sections