Overview

overview

10

Static

static

10

WMIProviderHost.exe

windows7-x64

10

WMIProviderHost.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    WMIProviderHost.exe

  • Size

    57KB

  • MD5

    7f4631cc67828fc55d6c8bd1af02bf44

  • SHA1

    54d6e1c3e0b655d231d461e32d187c0f2338295d

  • SHA256

    5361c6e459fd49ee6a11f586c5dd3a2626f1338cdc4ce661287f48966451a6dd

  • SHA512

    f931f8bde5aa6c2d528031fd5505eb6a0044edddcd1c5798ef762102e8d59e5701087259258d5cc15fea59e1e199f2c870fa95ad748a8e20680096cc4d62c348

  • SSDEEP

    1536:OP+vE3HHz3CIF9SYpNchQjbZ6cyW/bbOq4:O5T3CIF9SYE6bZH/bbOj

Score
10/10
xworm

Malware Config

Extracted

Family

xworm

Attributes
  • Install_directory

    %port%

  • install_file

    svchost.exe

  • pastebin_url

    https://pastebin.com/raw/GMv8QPCE

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm family
    xworm
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • WMIProviderHost.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections