Overview

overview

10

Static

static

10

spoof test.7z

windows11-21h2-x64

10

Resubmissions

04-12-2024 22:25

241204-2b8m1szpej 10

04-12-2024 22:22

241204-2adq9aznfm 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    spoof test.7z

  • Size

    50KB

  • MD5

    2b80931dfec2265ac0357414e27497f4

  • SHA1

    d7bfec86f61e214a8b43fcdcaaf82bda5e88557a

  • SHA256

    9f83ee8c3f2263e2400f1dc667c58520a846d81b12e8d15f62e4dfeba4389b3b

  • SHA512

    cb9443487acf4de4a33deb781ef206533cf5b4095671f08dd2b5607f388a82be8478b4db86b5ceaebb6f1dcd6958cd2d09399a0acea04ecb6d9368fb94cda203

  • SSDEEP

    768:AH1u19IsbaKCa8fll6kehelKR8e1vmrnwJU2O3QLp5OYgtf8aGZqfTn:AVuXIsqaSlRehZRBF+/pip/glOcTn

Score
10/10
xworm

Malware Config

Extracted

Family

xworm

C2

database-recommendations.gl.at.ply.gg:17666

Attributes
  • Install_directory

    %AppData%

  • install_file

    System User.exe

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm family
    xworm
  • Unsigned PE 3 IoCs

    Checks for missing Authenticode signature.

Files

  • spoof test.7z
    .7z

    Password: discord.gg/vixen

  • DiskHandler.sys
    .sys windows:10 windows x64 arch:x64

    5700fe089c5ee27b6d2a21d3dc70ffb5


    Headers

    Imports

    Sections

  • SMBiosHandler.sys
    .sys windows:10 windows x64 arch:x64

    54cc18583836740829cf45d883ba72a7


    Headers

    Imports

    Sections

  • mapper.exe
    .exe windows:4 windows x86 arch:x86

    Password: discord.gg/vixen

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • mapshit.bat