Overview

overview

10

Static

static

10

7d6ff01e6a...3N.exe

windows7-x64

10

7d6ff01e6a...3N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7d6ff01e6a8805bcc7678aabd3c71ba8493bc0e93cfa05c3c4a9621d481b26a3N.exe

  • Size

    62KB

  • MD5

    27073262c053ce8de5d3ca9cd80b04c0

  • SHA1

    f4958421fb58916bba8f78c914934eacbc4685f2

  • SHA256

    7d6ff01e6a8805bcc7678aabd3c71ba8493bc0e93cfa05c3c4a9621d481b26a3

  • SHA512

    53ebd126fc6a47bd3f73ddbc63f0963a3937348f7a1564af1d61d17536cef5a9c1618f38f73f501ccbbad80eeb83d569dadae266430ee69adfe9587a9359741b

  • SSDEEP

    768:9cSO/q11X3zEBAd+sSphlECCuyyzdXMgr9tLWbspkpNUfcTjYmQ6g8KOHhH9+0nu:Sj6GsSQyZMe9tSbspkYeK68OH22u

Score
10/10
xworm

Malware Config

Extracted

Family

xworm

C2

127.0.0.1:55303

NareReti-22747.portmap.host:55303

NareReti-55303.portmap.host:55303
Attributes
  • Install_directory

    %ProgramData%

  • install_file

    Updater.exe

  • telegram

    https://api.telegram.org/bot6840191997:AAGAMBGwNzL_wSKuYrOBbKDIGphrx-yRlhI

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm family
    xworm
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 7d6ff01e6a8805bcc7678aabd3c71ba8493bc0e93cfa05c3c4a9621d481b26a3N.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections