Behavioral task
behavioral1
Sample
PrivateChat V2.0.exe
Resource
win7-20240221-en
General
-
Target
PrivateChat V2.0.exe
-
Size
87KB
-
MD5
4e0daa19b125c8e2703e9de440b1340b
-
SHA1
8dd7592a40384093ab296ea4a0ae14102441b884
-
SHA256
2dcc9c629488710a424dba2eefcfbecbf1edcc092a8387be7929db59f9692e71
-
SHA512
8bf90f3d89e0592b5e5f1f6b1d5a362b1db84612eb8f737bec7e17c25e8e9748dd0293e40addea8f77c4f49e7e3a1e345ff78e1ee150dc29bfb643bbdb78e040
-
SSDEEP
1536:SPvg251EzYY2MkcqhQP6xY9G+beYZFy+U0/A1OG36zvO5d2LueRISbfX:SPvg2szr5kcqhgx8+be+yTL+OjOusr
Malware Config
Extracted
xworm
employees-resolution.gl.at.ply.gg:35582
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource PrivateChat V2.0.exe
Files
-
PrivateChat V2.0.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 85KB - Virtual size: 84KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ