xworm | 4bb12f4544cae3bd757015e45e37f010[.]bin | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4bb12f4544cae3bd757015e45e37f010.bin
Size

16KB
MD5

de178275a350bf54c6d7dbf5c04e3ea8
SHA1

3627a798d0619bd7610e9dccf4a3f5e6bb8bdf9e
SHA256

050396b092e9e294b0a114ea1229338f29f413039ba61ff24dbff10422627f15
SHA512

1e704c860f7f7493335a945d56438478ebc1bf1e5521f40bcd9143e26c9aeb918dc71e7d56e93833811af4dfca5934f18985e80e5d745cd42175228c5b100322
SSDEEP

384:DTIjy5k8pmxBk3bxsNBQzPLC+pXcWv0E6:ojyQxBWdsNuLNpXcWMx

Score

10^/10

xworm

Malware Config

Extracted

Family

xworm

C2

momentmoney79.duckdns.org:8895

Mutex

vuENodipV6RktoL9

Attributes

install_file
USB.exe

aes.plain

Signatures

Xworm family
xworm

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/8948b34d471db1e334e6caa00492bd11a60d0ec378933386b0cb7bc1b971c102.exe

Files

4bb12f4544cae3bd757015e45e37f010.bin
.zip

Password: infected
8948b34d471db1e334e6caa00492bd11a60d0ec378933386b0cb7bc1b971c102.exe
.exe windows x86

Password: infected

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ