General

  • Target

    fatality-password-123 (123).zip

  • Size

    29.2MB

  • MD5

    2d41ff52dc1e52d1cd699ca40a167b53

  • SHA1

    66d124bff088f410081c80e127562f3f811c745d

  • SHA256

    3078fd49e34b13f710f0b4d15b48f412ca8e5bbd7e6f9b9266cb29af0e0c37b9

  • SHA512

    8fea200e6104e181138c4d5678adad53c6c92bbf02961470c05e9d9d50533462811a246cbb0e8a64174d6077059bcb99896d1d1fae9a62fb026890a20b914753

  • SSDEEP

    786432:NkwzyLl3US+vSuB80vutpvHxTQXcF3T8QhjavVMNn7gJCtm9n:Nke2l3iSe800PewhuvKn0JCSn

Score
10/10

Malware Config

Extracted

Family

xworm

C2

22.ip.gl.ply.gg:35699

Attributes
  • Install_directory

    %AppData%

  • install_file

    svchost.exe

  • telegram

    https://api.telegram.org/bot7993755657:AAFO640EjOsY8e2cOR8daPzBSHn1uGW4C9s/sendMessage?chat_id=6749074492

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm family
  • Embeds OpenSSL 1 IoCs

    Embeds OpenSSL, may be used to circumvent TLS interception.

  • Unsigned PE 3 IoCs

    Checks for missing Authenticode signature.

Files

  • fatality-password-123 (123).zip
    .zip

    Password: 123

  • fatality-password-123/Fatality.dll
    .dll windows:4 windows x86 arch:x86

    Password: 123

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • fatality-password-123/Fatality.exe
    .exe windows:4 windows x86 arch:x86

    Password: 123

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • fatality-password-123/Magick.NET-Q16-AnyCPU.dll
    .dll windows:4 windows x86 arch:x86

    Password: 123

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • fatality-password-123/Magick.NET.Core.dll
    .dll windows:4 windows x86 arch:x86

    Password: 123

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • fatality-password-123/Magick.Native-Q16-arm64.dll
  • fatality-password-123/Magick.Native-Q16-x64.dll
    .dll windows:6 windows x64 arch:x64

    Password: 123

    d8fe8df0e1d2e4d172df63dfe711d7f0


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • fatality-password-123/Magick.Native-Q16-x86.dll
    .dll windows:6 windows x86 arch:x86

    Password: 123

    25138b97cd92cc9299412984404bc51a


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • fatality-password-123/Microsoft.Web.WebView2.Core.dll
    .dll windows:4 windows x86 arch:x86

    Password: 123

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • fatality-password-123/Microsoft.Web.WebView2.WinForms.dll
    .dll windows:4 windows x86 arch:x86

    Password: 123

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • fatality-password-123/Microsoft.Web.WebView2.Wpf.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • fatality-password-123/libcrypto-3-x64.dll
    .dll windows:6 windows x64 arch:x64

    680b5c239d82da8e527bf24b921948fd


    Headers

    Imports

    Exports

    Sections

  • fatality-password-123/libssl-3-x64.dll
    .dll windows:6 windows x64 arch:x64

    1dedd757946c1ca3c32f97146f7a6c25


    Headers

    Imports

    Exports

    Sections