xworm | hyukn[.]exe | Triage

Sharing

General

Target

hyukn.exe
Size

148KB
MD5

cef3a3fb369ddbf8d521a0ef2509765b
SHA1

75b454f0c15579b648b2925522ed18b22f41875c
SHA256

9bba4c75492332ad6ff30133a76baee064b60cf30e450c137386894986515f99
SHA512

e79e34253748146ce00458c4a4d97aae875c4f40715e750a7238a9beaec425ac1d96154f2c1b27e270a503c9669608f37d565fe093c887500c08b9cd6ee2cac1
SSDEEP

3072:Vp4YbV3AqHTKOZWnJtM+lmsolAIrRuw+mqv9j1MWLQg:VLbKq8nU+lDAA

Score

10^/10

xworm

Malware Config

Extracted

Family

xworm

C2

84.247.154.81:16623

Attributes

Install_directory
%LocalAppData%
install_file
USB.exe

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
sample	family_xworm

Xworm family
xworm

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
hyukn.exe

Files

hyukn.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 99KB - Virtual size: 98KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ