General
-
Target
scvhost.exe
-
Size
86KB
-
MD5
998e06781b0695341f2abee769694190
-
SHA1
1fa4561542815bdc3d3a743fb88c113aa235e7be
-
SHA256
5e74eb022765f689e0b68fe96fae9976c15cda61c971e2877bbbcb2d9034c441
-
SHA512
37eec973a006a155550d8c028a7a0971168e96b958b1531436f97c5a0109cbe0d5cac3a2108db5caf8f0801d9748e773c2170bd4b291dbb24eb72fa918dbc639
-
SSDEEP
1536:iC9Qk+FFlCIlwljtISE4H7yPiVwbgKPi0eV6GwZOTfz61OYO71NN:NQk+FEu860wbg4i0eNGOTr61OYOjN
Malware Config
Extracted
xworm
usr-contemporary.gl.at.ply.gg:59769
-
Install_directory
%Userprofile%
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource scvhost.exe
Files
-
scvhost.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 84KB - Virtual size: 83KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ