xworm | c83359f746eb240727873f83f3881db0[.]bin | Triage

Sharing

Copy URL Twitter E-mail

General

Target

c83359f746eb240727873f83f3881db0.bin
Size

32KB
MD5

c4c27a86c66eba9e39a7b40bbe1f181c
SHA1

e58b56f83e5d61e596d3394939b56268b8560ba9
SHA256

71fc094c9433f51afdce6a2f389b494409372da4b5617f9485fff7ceb9bd8e98
SHA512

0a1f5a94122b617efb20e31c9a74a63071d8bc9ecf354ddbef83549b0fdeb5daf6df133acfe81f3027c4d2f841a727a3d93870a9a5fbb0b61984e63b0aa87628
SSDEEP

768:2QBNfLPk2GPMNXCEaOu7Bo6qYSE0NJjqMZEcc/R5LDC:jMh0NxhYSEKdp3SR9C

Score

10^/10

xworm

Malware Config

Extracted

Family

xworm

C2

needforrat.hopto.org:7000

Mutex

4DmqnprMzJEWl3vs

Attributes

install_file
USB.exe

aes.plain

Signatures

Xworm family
xworm

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/ee7dd18f59e73fc4569a7a2564d52d6ee55b19757f89f57b17e35f32eb88327b.exe

Files

c83359f746eb240727873f83f3881db0.bin
.zip

Password: infected
ee7dd18f59e73fc4569a7a2564d52d6ee55b19757f89f57b17e35f32eb88327b.exe
.exe windows x86

Password: infected

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 43KB - Virtual size: 42KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 51KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ