Behavioral task
behavioral1
Sample
LoaderV5.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
LoaderV5.exe
Resource
win10v2004-20231215-en
General
-
Target
LoaderV5.exe
-
Size
74KB
-
MD5
6099c8cb0966b4ae9fdebd89ad36186f
-
SHA1
28b6d1c008e0ba9829e5e9cd55e6b9610b734ac2
-
SHA256
21e86b3f3f3532e5857d69f35bf5fa8a70886151a184f9a63e048738c93b02e7
-
SHA512
581b97b78c46820b47267c147256a6f3cb9f42517adb6c3ef984e15695517d5c5f26b5992cf3849107038a1c5048cf84ba9eb08604458889a1ada6470121e8ba
-
SSDEEP
1536:wbUuB9ngQ/Xbi8i7RFVOucMXib97XirR6KbpOkVNnz:aU+pi7Jt+b9DebpOkVNz
Malware Config
Extracted
xworm
centre-shaped.gl.at.ply.gg:30014
centre-shaped.gl.at.ply.gg:30014:30014
-
Install_directory
%AppData%
-
install_file
Updater.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource LoaderV5.exe
Files
-
LoaderV5.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 72KB - Virtual size: 71KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ