General
-
Target
fixer for multitool.exe
-
Size
87KB
-
MD5
99e39146427de4c24dd3f1ff1ed4debe
-
SHA1
c7b51946c52c902c5af7f228613cb00660f15134
-
SHA256
f4c783c56c8cf963890638302a5e92c8e49181b4813f7fa10f2f537ed944ae45
-
SHA512
727a8ae888af56cdf680f163783c554c076451708a3d80c5147af3a10922d6a8edf65c2ec4cfe5552e79317f9be336623e7be4f0fa5ff6a29ed12e08a7fbcc98
-
SSDEEP
1536:imR/EoP7RfUQ3ut4LhZm3BuASk1x9bpcRjkHM3amui1/cZ6DGiOKWP1WlGOOn+P:iW17R87UM3BVx9bpLHMqmuIEYOKWP6GW
Score
10/10
Malware Config
Extracted
Family
xworm
C2
blood-pattern.gl.at.ply.gg:24558
Attributes
-
Install_directory
%AppData%
-
install_file
USB.exe
-
telegram
https://api.telegram.org/bot7704029346:AAHPre1lXQa0UfPCpOUXJZ9UXA9mFxvH4Gk/sendMessage?chat_id=7590668020
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
fixer for multitool.exe
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections