General
-
Target
Nexus.exe
-
Size
40KB
-
MD5
0b677bbe363ea393d2a1152b9c9c67d7
-
SHA1
956f8c498490c595df946763d486c9016839f1b8
-
SHA256
960c31ec0fad0f80d726d3a91d9bbbc68c34c09a60f9381a87a589eee8814133
-
SHA512
f24a1bb67caed2487f78be90ae728c8ed386e46ef0159c188d0b8b05e479731b5ccb1b298e8e00db0b5c8a5d145dca3d56435b95ce0099286150fa814aad11c8
-
SSDEEP
768:36Pq4VSviT+oGQAyAqbA8K7tF5Pq9IUOMhY3/Rsq:gvSqT1HAzAVKxFk9IUOMepr
Malware Config
Extracted
xworm
5.0
85.203.4.69:1999
nejvXraHvLYWkslH
-
Install_directory
%Userprofile%
-
install_file
csrss.exe
Signatures
-
Detect Xworm Payload 1 IoCs
Processes:
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource Nexus.exe
Files
-
Nexus.exe.exe windows:4 windows x86 arch:x86
Password: @Bankty
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 37KB - Virtual size: 37KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ