Behavioral task
behavioral1
Sample
black redux.exe
Resource
win7-20240220-en
General
-
Target
black redux.exe
-
Size
37KB
-
MD5
3e3db93c47cd100ebbf71d9fc431d3a8
-
SHA1
c1fe2807817ea8637c898e17256c307151ccd3b4
-
SHA256
aa18e2163cb0232d29caf43ec59d1b5f1b56095ec4e68c8702059eba6fbfa4b8
-
SHA512
a767559d941c3041a55ea54faf139c5652c8e442ff1681e69bcb602762b209c3bca3768de6ee30eeb70c0edfa8c1d48aabf50ec11f3c5c9e78e393f1ac4a13c8
-
SSDEEP
768:Bv+ieKj7OGlx9ZqDAPFy59IsE6COjhNbpEFk+:Bvu2H/qGFw97E6COjtEJ
Malware Config
Extracted
xworm
5.0
tool-seven.gl.at.ply.gg:52445
VgdpDpCKTFyFQbQO
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource black redux.exe
Files
-
black redux.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 33KB - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ