General
-
Target
---.exe
-
Size
65KB
-
MD5
f6245dc4b99287b77839650384a3fb88
-
SHA1
a3f0a8dd7abc27abfcf7f3435d2d9f154cd1a698
-
SHA256
9da7a88b44357e6105c585feef826676661de0fea05b6e81f9776a8ae79e803d
-
SHA512
4e26ba83bbaa25e6273f8f26d5eee1983ac997a7eff8950d2068c9f7c6d6384c8c5ea0ac2547875f700fa6ad7f452b7d593283be1c7c32a4d3294a0f56b97a4c
-
SSDEEP
1536:w3br0QpFVCLKKscv2vP40eROKjb7rq/syr0O0zJT92:6rLgLKA+vHeskb72kygO0z6
Malware Config
Extracted
xworm
127.0.0.1:5555
16.ip.gl.ply.gg:5555
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ---.exe
Files
-
---.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 62KB - Virtual size: 62KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ