Behavioral task
behavioral1
Sample
Stub.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
Stub.exe
Resource
win10v2004-20230915-en
General
-
Target
Stub.exe
-
Size
59KB
-
MD5
5e898023998ac0c862eb3bd9694675d4
-
SHA1
1723f8f80a10a486e4e6bb080dd202a54546b108
-
SHA256
fb0d45b0e48b0cdda2dd8c5a152f3c7a375c18d63e588f6a217c9d47f7d5199d
-
SHA512
13a325448f9333d9a00e5e6cc8d2404a8bcfb2092648811f2c652e20ec3dce0068c5945912fe846452d0cb1902792b21a020f86068d1bb11e22252348d13d64f
-
SSDEEP
1536:NaagCTl3+ZVgvPgD79QZbIzaJh7PtzO022U:FgCF+ZKvPhZbICJ1zO07U
Malware Config
Extracted
xworm
3.1
mo1010.duckdns.org:7000
-
Install_directory
%AppData%
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Stub.exe
Files
-
Stub.exe.exe windows:4 windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 56KB - Virtual size: 56KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ