General

  • Target

    Wallet_Crackerinfected.zip

  • Size

    768KB

  • MD5

    bdb9582ced92dd1147098f2e007225c0

  • SHA1

    53a5f2faa7491b85530a2b51490308732aa797d2

  • SHA256

    7d104083d0598fe421a7ba0d2ab9f10a1da8666a87266ab949c0b0cdf386da4b

  • SHA512

    41d6ba0c82e75568ac55728d0a8f06b6c4d3d73e360845176d6f8824f7057e71ea580b9f200db1e1c1c4062da4342ff4f5480d308872134dcddd8679cf367f40

  • SSDEEP

    12288:1m1sY0lKbZnft77JowFHmoESN+I2PML1Zl9YzWf+/SMIsgqiUy5VVkNy:OsY0IZftfJoQHbAbPMxZvYc+G2xyD

Score
10/10

Malware Config

Extracted

Family

darkvision

C2

45.200.148.238

Extracted

Family

xworm

C2

127.0.0.1:7777

45.200.148.238:7777

Attributes
  • Install_directory

    %Userprofile%

  • install_file

    XClient.exe

Signatures

  • Darkvision family
  • Detect Xworm Payload 1 IoCs
  • Xworm family
  • Unsigned PE 2 IoCs

    Checks for missing Authenticode signature.

Files

  • Wallet_Crackerinfected.zip
    .zip

    Password: infected

  • Wallet_Cracker/Cracker/Tool.EXE
    .exe windows:5 windows x64 arch:x64

    6ec52816fe4a1f404eaae46e8a806d5f


    Headers

    Imports

    Sections

  • Wallet_Cracker/Cracker/hook.dll
    .dll windows:5 windows x64 arch:x64

    a07b19e5fe0a4bf885c59e0bf341a62f


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Wallet_Cracker/README.txt
  • Wallet_Cracker/Setup/Setup.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections