General
-
Target
hack.exe
-
Size
155KB
-
MD5
2c4a39f9ac5bd64866032c0bd7faa9c5
-
SHA1
ed6fdf71f0d0fedf29f6b78a207f5710426da78f
-
SHA256
f38da3e39db37247e99bcbebfcd72a7ccc5811bbb1a7aef61ee310d15f7b1564
-
SHA512
851127dd54647723eac9e61da7a85094b0b554fe2ef2b2885d89eb36807cbb7daf1ea2193d2f0b000131bcd4dc66ec6e2c16812e6d5a85ad987e35ae4ba0e05f
-
SSDEEP
1536:3bRPzxY+ltJ7Fg9Bh8OMB4jls3WGkoe6Us89T8r9AtnertLFH:3bRPG+hFg9BWOM+a3v7EskT8rmtIhH
Malware Config
Extracted
xworm
5.0
glass-coffee.gl.at.ply.gg:5417
NXMplQ2VmD02KTh5
-
install_file
USB.exe
-
telegram
https://api.telegram.org/bot7244696222:AAHqbV7Klrbtt5G5MocnpyydNFGt1mksjWg/sendMessage?chat_id=5854542114
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource hack.exe
Files
-
hack.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 37KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 117KB - Virtual size: 117KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ