General

  • Target

    KeyGen.exe

  • Size

    71KB

  • MD5

    7addd5b9c97fa34625567991ad42a6b0

  • SHA1

    305a6af73234cb5d7c4fab4ecb35751af2977a8c

  • SHA256

    35b6f516e20f2d01dd638055decb824ee2d83d23d7d01fe010d92f22a0e38911

  • SHA512

    aca3379e929a38f61a3e096f74618fe761d2f0723d36f0e2bd2eb37f141e87cff5ea62bc9ab4deffc07c615f579a976951ee7393ee495b32a3d57a724a1072f7

  • SSDEEP

    1536:VRLxhVj7D+Ihw3+bwxK0ZV6ypm6TNOQRu0US6Sd:Vb7hw3+bwxtQOOQRb0s

Score
10/10

Malware Config

Extracted

Family

xworm

C2

127.0.0.1:1139

w4wrzaq8l.localto.net:1139

Attributes
  • Install_directory

    %AppData%

  • install_file

    USB.exe

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • KeyGen.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections