Behavioral task
behavioral1
Sample
94c1b83e9181e597748af34aa30324fa001324bd12d33b12aa01e2a05ba779d6.exe
Resource
win7-20240508-en
General
-
Target
94c1b83e9181e597748af34aa30324fa001324bd12d33b12aa01e2a05ba779d6.exe
-
Size
58KB
-
MD5
090b76b0c6152ea71f08d1e9ae8f3742
-
SHA1
ff5ca08e6d69cb68a76422e804b0574d551ed20e
-
SHA256
94c1b83e9181e597748af34aa30324fa001324bd12d33b12aa01e2a05ba779d6
-
SHA512
dc10df4bbf0a114524ef74d3fd8b189f2f9cbc46825300c820699cafe2a0d57e94b6a39be607882b5f802f8f94b4f0a46745ce6a1e7c8f0ce7c5fe98c2414871
-
SSDEEP
1536:sxROmGFPI63TkSO7sXp+bF12x6fk+xOz2xc2/:EYoc+bF1jkuOz2mg
Malware Config
Extracted
xworm
104.250.180.178:7061
-
Install_directory
%AppData%
-
install_file
XClient.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 94c1b83e9181e597748af34aa30324fa001324bd12d33b12aa01e2a05ba779d6.exe
Files
-
94c1b83e9181e597748af34aa30324fa001324bd12d33b12aa01e2a05ba779d6.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 55KB - Virtual size: 55KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ