xworm | discord[.]exe | Triage

Sharing

General

Target

discord.exe
Size

71KB
MD5

5cd36283137aca8c57f6a2da6b293e2c
SHA1

c22ee31c0dd60b798fb9fd5fb4560e19883d8949
SHA256

2386d4d125b81302815c115c1959001ddd06e0c2806ac1ea655c65249bda30ff
SHA512

0ad0971c7f099cfe652bf61c709fb402a7d1089e43cfddae671d64a3d0787e3c3620fce0db7b080e731ab91c038f18e237fe062e6eb8d96eaeaed5a06a12a3ee
SSDEEP

1536:0Ps9hY5Ks/4byPelp+qp67TwpKFfnOiFElOi5Y:0WK594bse7jawpKFfnOmSFY

Score

10^/10

xworm

Malware Config

Extracted

Family

xworm

C2

engine-romania.gl.at.ply.gg:37581

Attributes

Install_directory
%AppData%
install_file
discord.exe

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
sample	family_xworm

Xworm family
xworm

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
discord.exe

Files

discord.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 69KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ