xworm | XWorm_DNS[.]exe

General

Target
XWorm_DNS.exe
Size 32KB
Sample230708-vcs6dsfg92
SHA256 89c13d0d555824acb2e24f61d92fc6fb3dce46d6af5d1df86e683eb9c24eb3f0
MD5 40a3ded02fdca319adfb4cb131c67e55
SHA1 a0546dcea43a56ee56e30c7acbd3accb75b3fbae
SHA512 26baa8fb10bdf1b96e14bcc97a23805b481f28b47fb731d2a1c71ff13bf23aa2687ef6d21b1d415cb2c287e21b2125b6800ad3202c9bd4ef2dc341ca85f4749e
SSDEEP 768:sdSt0lwAfTQotNDflzs0cGZFh9AvrjO/h0/h+7:sQt0lwcts0cmFh9AjjO/Oc7
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xworm

Malware Config

Extracted

Family

xworm

C2

caloi1920.ddns.net:4444

Mutex

HzYMmjPQMTRUayN2

Attributes

install_file
USB.exe

aes.plain

Signatures

Xworm family
xworm

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
XWorm_DNS.exe

File Explorer

XWorm_DNS.exe

.exe 32KB

XWorm_DNS.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 89c13d0d555824acb2e24f61d92fc6fb3dce46d6af5d1df86e683eb9c24eb3f0
MD5 40a3ded02fdca319adfb4cb131c67e55
SHA1 a0546dcea43a56ee56e30c7acbd3accb75b3fbae
SHA512 26baa8fb10bdf1b96e14bcc97a23805b481f28b47fb731d2a1c71ff13bf23aa2687ef6d21b1d415cb2c287e21b2125b6800ad3202c9bd4ef2dc341ca85f4749e
SSDEEP 768:sdSt0lwAfTQotNDflzs0cGZFh9AvrjO/h0/h+7:sQt0lwcts0cmFh9AjjO/Oc7
MD5 SHA1 SHA512 SSDEEP

windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

38894

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Sharing