Overview

overview

10

Static

static

10

spoolsv.exe

windows7-x64

10

spoolsv.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    spoolsv.exe

  • Size

    135KB

  • MD5

    fcfae4fdcc273f8a46c51d49fa8a4a03

  • SHA1

    3a0e314b7bbdf5467df8b92a348c1b464fd502b0

  • SHA256

    49ff687dbb13ed84815f3f57c660a0a4fc5cb21c82b605ce53338538a864586d

  • SHA512

    50e6960d98dbc8d63975b0514deb6e9f7266a054e129902ac2ecf7c8500c84e5125d4896c9ec54a4187971832abfe2c575fd4c166baea39712b35f2f35e000f7

  • SSDEEP

    3072:pG+KeZW7bSWaWDbkDOrZBRHQbPRyZ2pPYU:pU17buWDbkiBR8AZ2

Score
10/10
xworm

Malware Config

Extracted

Family

xworm

C2

78.70.235.238:7000

f8terat.ddns.net:7000
Attributes
  • Install_directory

    %Temp%

  • install_file

    spoolsv.exe

  • telegram

    https://api.telegram.org/bot7742194912:AAGSH51C4BpkbbvEQlO-cv-lDoJZMVxqyN4/sendMessage?chat_id=5456205643

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm family
    xworm
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • spoolsv.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections