Behavioral task
behavioral1
Sample
46f16261cc1ad6d2975a966ad97ef1752027e67795333a27ed01353d688317b9.exe
Resource
win7-20230220-en
General
-
Target
Xclient.zip
-
Size
37KB
-
MD5
681b966993378a2b076e6172eaf2f58f
-
SHA1
256638249e7379fce7efcd398398da346d3502aa
-
SHA256
b284e4f4047ec04542fc1a2c87d779229f5ad4ab6c4e02d7f0ff6806df8a4563
-
SHA512
460f490812855c75035ac4ed047f5019fb2dc4b620c5317348e5aabd0ab0ff03d185b6f081809c78a1ef044bbc06b2c6c8b628266e8918ebae1c98cd94ab447c
-
SSDEEP
768:ydN5LbMmQ9lS532hD9obM8EOb4xqf/vrlQz33qRcLWROM8uEQVIevD4w:yRO9lC3+KQ8J4wfLCeRcLoE0LN
Malware Config
Extracted
xworm
venom.giize.com:46876
-
install_file
USB.exe
Signatures
-
Xworm family
Files
-
Xclient.zip.zip
Password: infected
-
46f16261cc1ad6d2975a966ad97ef1752027e67795333a27ed01353d688317b9.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 59KB - Virtual size: 59KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ