Behavioral task
behavioral1
Sample
nigger.exe
Resource
win11-20240611-en
General
-
Target
nigger.exe
-
Size
59KB
-
MD5
d6e2cb30e0f2262a1bbb73e6eae2eeed
-
SHA1
89131a5014f50474ca87dea770cbfa4e183a4922
-
SHA256
9620d0fc6e70716cfea243bdeae0273c32e8c90c1b16130b958cd103c535539c
-
SHA512
2d93a5dc4e6ee80ada16487cabaf0c7941393dcd593157230f4429fd6069014942c5956704aa13127c5949b7e4c64adcd566cc90b141b37939deb3c71f547a1e
-
SSDEEP
1536:fVugPfJoAXQX7Y3UIUmbEOz8hoq7K6QzOPLHFBTJ:fVAAYYEIUmbEOgh98zOjlxJ
Malware Config
Extracted
xworm
-
Install_directory
%AppData%
-
install_file
dllhost.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource nigger.exe
Files
-
nigger.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 57KB - Virtual size: 56KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ