General
-
Target
XClientds.exe
-
Size
30KB
-
MD5
e66b0351050b2a5a13d2bd5efe48f62c
-
SHA1
4065d55a04d2891630a446d864848d7cad87ea42
-
SHA256
da41a92e57ecb1fba092cb0b2bccca4cfdce50819cdd71c9cd4fa52d14a62f22
-
SHA512
f88e9ce4c94a1a14018a65bf608823eba76ef113dcc06d7b873b0185724cca9e6678fb6556c1d9d5ca918b90b7c3a9394281c257566c28c185756a424d16cef4
-
SSDEEP
768:Fecbl/b32MYAoRN9M2uBFE9RFPOqhAbQ:kcxg9M24FE9R9OqKs
Malware Config
Extracted
xworm
3.1
209.25.141:5525
mibJGgSYBrOeckGq
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource XClientds.exe
Files
-
XClientds.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 27KB - Virtual size: 27KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ