Behavioral task
behavioral1
Sample
3aded3505bedac0c4f9f60f05eec055e.exe
Resource
win7-20231129-en
General
-
Target
3aded3505bedac0c4f9f60f05eec055e.exe
-
Size
34KB
-
MD5
3aded3505bedac0c4f9f60f05eec055e
-
SHA1
3299769e35be4b1830d6b4b52ced966e7f639910
-
SHA256
7ef2ec455625ed3cadf84defc1f8c6ad4e50ff570a8bc9399c183f1fb6db64ae
-
SHA512
018675674e6db18bb29470b5a5febec36d4d09556f85d146a38849488d4c4d8df8722651a65220a241d0b4e3af2a55d72090fc001658ee84e24809ff3c91ea15
-
SSDEEP
384:UD6h3R8qe1GPe9YcX5kMgSDFI+cLayQDpIpaPh3xv8RMpkFXBLTaOZwEJN2v99IO:3BfSDK+4aLj3eRFC9j0eOjh5by
Malware Config
Extracted
xworm
5.0
C5zPeIg81nMyuoUg
-
install_file
usb-system-driver.exe
-
pastebin_url
https://pastebin.com/raw/k8J6kC4f
-
telegram
https://api.telegram.org/bot6617492819:AAENJ7h84zjCPl1oaa-twc_OwH5DJz0kNjw/sendMessage?chat_id=6374419021
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3aded3505bedac0c4f9f60f05eec055e.exe
Files
-
3aded3505bedac0c4f9f60f05eec055e.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 31KB - Virtual size: 31KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ