General
-
Target
roblox multitool.exe
-
Size
83KB
-
MD5
cb0546adb41f324fcacb08df0f6ea3c0
-
SHA1
6c1cc4d746858e4ed050f83583e5f882af76b346
-
SHA256
6ff48a0d7a47aa76f223ae272eb73caa5a8cf343a4e1a165a30017b20511d317
-
SHA512
a6927e5ec4efc4d02927af38e1c2aed95f8f6350dcc37146257f31cf98786b156035d136c43969b359c7a3e9edcb16504f24be28d229a73fa0cda782c8c52888
-
SSDEEP
1536:KmA2x/2kxoQkhGxN6Qsv0HokBXkU69bWioLJpJnCilB6KxyknLKqO5tzKH2K5n+W:Km/610CsIyS9bWioTIGTEamqO5gH2O+W
Score
10/10
Malware Config
Extracted
Family
xworm
C2
blood-pattern.gl.at.ply.gg:24558
Attributes
-
Install_directory
%AppData%
-
install_file
USB.exe
-
telegram
https://api.telegram.org/bot7704029346:AAHPre1lXQa0UfPCpOUXJZ9UXA9mFxvH4Gk/sendMessage?chat_id=7590668020
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
roblox multitool.exe
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections