xworm | 7e2be4ac04d8f56473499eac3a10fb34[.]bin | Triage

Sharing

Copy URL Twitter E-mail

General

Target

7e2be4ac04d8f56473499eac3a10fb34.bin
Size

134KB
MD5

d9db71248659d20a5beea1e229572e5e
SHA1

d947401cb419b042e0e435be96502bfb2c545070
SHA256

411525b7d0a17be6b6117e599536fc25054a3b2e9e6546c75cca09e561fc9d61
SHA512

d8a4195ffe09d71a885e77e9a876c34a48fa59bcb51cd1df69a560b46d54c51568536b9fc4e97c6adb927b9a900c83000ab28346491122c5e91fd956e278656f
SSDEEP

3072:hJ5kEISQbjMr7qkwRzwJJV9V2Ab1/Q4N8vu:hJ5hZRri4VZH0u

Score

10^/10

xworm

Malware Config

Extracted

Family

xworm

C2

6.tcp.eu.ngrok.io:18052

Mutex

hMwsB2Kl8eJNYZZz

Attributes

install_file
USB.exe

aes.plain

Signatures

Xworm family
xworm

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/ec6a6aa9a75e81c6069edc6bd5e246062ae923348d7c2221eb5f8fa3f59b63a8.exe

Files

7e2be4ac04d8f56473499eac3a10fb34.bin
.zip

Password: infected
ec6a6aa9a75e81c6069edc6bd5e246062ae923348d7c2221eb5f8fa3f59b63a8.exe
.exe windows x86

Password: infected

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 166KB - Virtual size: 166KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ