xworm | notrat[.]exe | Triage

Sharing

General

Target

notrat.exe
Size

51KB
MD5

5ec8aa999dbe61e15500812a06f678f1
SHA1

8882c4d620eae217e9dbab539811c336f1cc0d59
SHA256

26ad2e3f7bae463a2ca610e733977148b49627aeaa070c543179544a1a26557c
SHA512

a5503f857fabd846b5d7d6f7e9771ad634d402846e4cf12d6c28a6d2845c3787030d7a3cfc8d48aa2dced16d1bc6c7e57394905a27ed70b57943d7dd2cbd57cf
SSDEEP

768:FKpjk78AwHS20x6/fXYnQpvEqBaBK/kbNZJgQCy36/8WzOUh6Mo4HD:Ypw8yMfXYQsqBaB+kbNZJT6/JzOUPj

Score

10^/10

xworm

Malware Config

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
sample	family_xworm

Xworm family
xworm

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
notrat.exe

Files

notrat.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ