Resubmissions
24-06-2024 18:41
240624-xb9svszflq 10General
-
Target
XClient.exe
-
Size
77KB
-
MD5
64d362a144056d1d694cd6ac91b05853
-
SHA1
26ff11d8079cfcbcd030c7b8ff6b468e64fe6646
-
SHA256
20a5a326453f45148d45dae9a082cb81e94d8d6bf738b690f3108421428aba19
-
SHA512
e3ca6dd9b7610cf56a538ca49ef39e3ac26586a998d838b75bf0e7e3690745c245327591ff129e8d9036e17fccc163177c6df19815874810b75d3c7e53d1af96
-
SSDEEP
1536:XwAs1Jl/UONC4QRm4mUHHbPud6Xby/Kbokf38ZeXGWEt2OJoBhQVRDCP:XwAsFcEC4QRjS0by/7kfat2Oi4VJC
Malware Config
Extracted
xworm
66.66.146.74:9511
-
Install_directory
%AppData%
-
install_file
XClient.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource XClient.exe
Files
-
XClient.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 74KB - Virtual size: 74KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ