General
-
Target
rat-virus-DONT-INSTALL-main.zip
-
Size
276KB
-
MD5
f911d77f502e7f058f91acdefb066903
-
SHA1
88584002780fe8cc10d1d27fc398f1f0d383b5a3
-
SHA256
1470a3336049aa3867b95b23f2671b64eebf2c79fbde95e860c6f592da96d0f7
-
SHA512
acda500653f12d3163af90f89bc6cb115fb633e172f13bd4d5da71b5dd43f33fe6204eb06149bdb462ed964c43244a3d4dc1854482f1f4c8e77a3065be905230
-
SSDEEP
6144:XIs3ZouAhKw+dzuGrqDHMmkXLJXR6y5QNWGwiH9UG8T:XPpouIL+dCwbnv6nzOG8T
Score
10/10
Malware Config
Extracted
Family
xworm
C2
saw-proceedings.gl.at.ply.gg:7021
saw-proceedings.gl.at.ply.gg:16297
Attributes
-
Install_directory
%AppData%
-
install_file
USB.exe
Extracted
Family
xworm
Version
5.0
C2
saw-proceedings.gl.at.ply.gg:16297
Mutex
sr2CYoJagZJqSlDE
Attributes
-
Install_directory
%AppData%
-
install_file
USB.exe
aes.plain
Signatures
-
Detect Xworm Payload 3 IoCs
-
Xworm family
-
Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
Files
-
rat-virus-DONT-INSTALL-main.zip
-
rat-virus-DONT-INSTALL-main/README.md
-
rat-virus-DONT-INSTALL-main/gfdgdf.exe
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections
-
rat-virus-DONT-INSTALL-main/ratka_dontopen.exe
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections
-
rat-virus-DONT-INSTALL-main/remota access trojan.exe
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections