General
-
Target
FireFox (2).rar
-
Size
38KB
-
MD5
fbb13804f3829473e1d1b4ae9a8adaac
-
SHA1
3f6af28fd3da62b79abf154c1c182c5985ed1ac2
-
SHA256
837894140f7f6c20d9221e75fbe1a79487cd75c88cbe431d6be59768bd260bee
-
SHA512
e5caa9d376823333788db78a7565d55a19ee06e67ab39b5512a441cf03de5a5621bb9d2a2f1a861541e67a7322872feb08effc2d00d5a786538e8d6573774882
-
SSDEEP
768:KNLlgH+iCvyX723Spn9kZz1gykuTuv5/Rv2RiT0pN/XuDtjT+F2csj6NdM:KLJFvu72snoSy5TuVRe/gjTcMd
Score
10/10
Malware Config
Extracted
Family
xworm
C2
127.0.0.1:28938
so-trek.gl.at.ply.gg:28938
Attributes
-
Install_directory
%AppData%
-
install_file
svchost.exe
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
FireFox (2).rar
Password: 1
-
Новая папка/XClient.exe
Password: 1
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections