Behavioral task
behavioral1
Sample
2024-06-20_242a3e502e079a2a92fa07e425fd9c07_hiddentear.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2024-06-20_242a3e502e079a2a92fa07e425fd9c07_hiddentear.exe
Resource
win10v2004-20240611-en
General
-
Target
2024-06-20_242a3e502e079a2a92fa07e425fd9c07_hiddentear
-
Size
168KB
-
MD5
242a3e502e079a2a92fa07e425fd9c07
-
SHA1
a253b70e63b6038d52af274a795fef65c61590b7
-
SHA256
fa94c4ffdaacecbaee942892cdbdc69b35bd8efabef1a5b8314ac22626b025be
-
SHA512
a91b4c81973d96a66fc1af9fe8e798867f01b9dd1bde850548614c68e99c7f0fc00f9420d70666a4eec69bab095f4ec800a05fa4a42f42fbd271cf39dac9bce4
-
SSDEEP
3072:DMQMWFZ93KOAHrM+lmsolAIrRuw+mqv9j1MWLQI:DR5Z91+lDAA
Malware Config
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Detects Windows executables referencing non-Windows User-Agents 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-06-20_242a3e502e079a2a92fa07e425fd9c07_hiddentear
Files
-
2024-06-20_242a3e502e079a2a92fa07e425fd9c07_hiddentear.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 43KB - Virtual size: 42KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 99KB - Virtual size: 98KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ