Behavioral task
behavioral1
Sample
2b4e182346941bda5b768cb7ed97eeddc95a0ccb490ff60fa840fcc2af56ffe6.exe
Resource
win7-20240508-en
General
-
Target
2b4e182346941bda5b768cb7ed97eeddc95a0ccb490ff60fa840fcc2af56ffe6
-
Size
67KB
-
MD5
a53085f566da131e85333f971652e3d6
-
SHA1
3b7ec64c7ffc429150abd7a827a993510477b142
-
SHA256
2b4e182346941bda5b768cb7ed97eeddc95a0ccb490ff60fa840fcc2af56ffe6
-
SHA512
ae800ab0b46c5956511869948d21a7f60a6ea1236774a1cc9b71a702bd51ef14de605efa16ab36a5c1c2bd45ea807519de096baedae16900693d9c0eb460fddf
-
SSDEEP
1536:h6jdv08xPTOi7R5WZat5Wd5Skboxm1ZGEH266O6Ekor0F:hs6i7RFpkbox88EyO6FrF
Malware Config
Extracted
xworm
bay-cf.gl.at.ply.gg:20819:8848
188.254.126.46:8848
-
Install_directory
%AppData%
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2b4e182346941bda5b768cb7ed97eeddc95a0ccb490ff60fa840fcc2af56ffe6
Files
-
2b4e182346941bda5b768cb7ed97eeddc95a0ccb490ff60fa840fcc2af56ffe6.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 64KB - Virtual size: 64KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ