General
-
Target
Cheetoo.exe
-
Size
64KB
-
MD5
1cd4fcaf1246fdba4ba570014dad45a2
-
SHA1
6a2d07f4cb99f89fceb58ed71c3b31834b340ff5
-
SHA256
fef0efa8dae53eb4702b0197685c3fef02b261fc988f577b61a6af0bafa7af83
-
SHA512
62be67703eb8add88141573fd6cb1cdc0dc7cff2d53df7fe449ebab95c4feeb655f93ff921d9a56f9df4920174b60d240cb8c9c02d68adfbadc0647cabfe89ce
-
SSDEEP
1536:p9J/i4BM+IKJ92GCvCLY9ln61GYIxVbqpoDZvXRdO+0cy3s:pT/DBDIKJMXKLY9961NyVbqCD9XnO+Is
Malware Config
Extracted
xworm
3.1
193.161.193.99:50291
-
Install_directory
%ProgramData%
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Cheetoo.exe
Files
-
Cheetoo.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 62KB - Virtual size: 61KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ