Behavioral task
behavioral1
Sample
HWare Rust.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
HWare Rust.exe
Resource
win10v2004-20231215-en
General
-
Target
HWare Rust.exe
-
Size
67KB
-
MD5
1b898ff48a61e22368af85912a7eede0
-
SHA1
25ba2423ebac1881bb6d4e387fae9457114656ad
-
SHA256
c6209a860028c241480083ec3ded938c59cd008f88999a0eccdc66d82c12261b
-
SHA512
1f817211584d0198f1996e3da87b9965e6b6db8d979ddcc6e8c396cb7a5fec06cc998c1b4e2c7b8af7bae19be66ffa111a9363f20cd1514c7aa5a0a9726356e6
-
SSDEEP
1536:B40xJxlgXcnqlMGVNaiKbXJsrPPCiIe06bTObekGu:Z3gsn6M2TKbXb7ehTObvf
Malware Config
Extracted
xworm
127.0.0.1:8808
77.34.131.206:8808
-
Install_directory
%Public%
-
install_file
taskhost.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource HWare Rust.exe
Files
-
HWare Rust.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 62KB - Virtual size: 62KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ