xworm | 0d8c4ca04dcbd59ba33f260bc450295e[.]bin | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0d8c4ca04dcbd59ba33f260bc450295e.bin
Size

16KB
MD5

df2915d82493eec429610f58f44d7c31
SHA1

68c892b022d3217f4d4f88187a151c2a344bc511
SHA256

77027cb0bf5627043a38893228e0cfe21a0a31d2c78b3978118b8460c4d0c80b
SHA512

d0964c2b473651fd50071e3a9c3b8c98e15c2ccc082eb37525572192070aa969c3815c8965fe23a83fec438a014d77f8a6c98354a164b0e0df0624ed2f475849
SSDEEP

384:AbXDXp2yLJgMWLbhE56yXKsukMTHK/32yUEUAsEjbNni:GXDXp2yLaFasy6suRTUlXUAzi

Score

10^/10

xworm

Malware Config

Extracted

Family

xworm

C2

185.225.73.47:1111

Mutex

Hcz0yq66jVLvPO4W

Attributes

install_file
USB.exe

aes.plain

Signatures

Xworm family
xworm

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/a447fee5372ccb5a4efc5daf48f497d921a7dc01d3d4f24dd3c4319da9f55ae4.exe

Files

0d8c4ca04dcbd59ba33f260bc450295e.bin
.zip

Password: infected
a447fee5372ccb5a4efc5daf48f497d921a7dc01d3d4f24dd3c4319da9f55ae4.exe
.exe windows x86

Password: infected

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ