Overview

overview

10

Static

static

10

188d525dae...ed.exe

windows7-x64

10

188d525dae...ed.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    188d525daed5c014ea5ae62a1fd1841d783693e41712ea58b9906cda2b60dbed.zip

  • Size

    49KB

  • MD5

    cf2d1f8d317dfeefea48a2d2c23ffca8

  • SHA1

    3313f86429b8c99c15b12654b61cb17670b76579

  • SHA256

    25f61938ed5473d78506a19592f356a585bb2422cd3d189f9c45d2113a0a59b8

  • SHA512

    5e431800981ba0e0a2bd08ef843eb8f780cd93af700861058db002ac8a4f016f7d3990c6ec7e95ff710d7813817f152fee5fedf97448d1d38b0fe6d09a44a532

  • SSDEEP

    1536:pUthTwD+LURGc1mNhhIIMvIwjWIbNE3h+ghttw:6jgGemNhmIMvXzqx1h3w

Score
10/10
xworm

Malware Config

Extracted

Family

xworm

C2

127.0.0.1:36623

fax-scenarios.gl.at.ply.gg:36623
Attributes
  • Install_directory

    %AppData%

  • install_file

    SolaraX.exe

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm family
    xworm
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 188d525daed5c014ea5ae62a1fd1841d783693e41712ea58b9906cda2b60dbed.zip
    .zip

    Password: infected

  • 188d525daed5c014ea5ae62a1fd1841d783693e41712ea58b9906cda2b60dbed.exe
    .exe windows:4 windows x86 arch:x86

    Password: infected

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections