General
-
Target
Teams.exe
-
Size
173KB
-
MD5
a3b6d62803572915891a21d0517b10ae
-
SHA1
fe76c654b5e598733c0e04d65a6f114ab7099f58
-
SHA256
36f07e44f833615b17e74b64a4734a6e7c302dd1f97827d46bd913e8f79517ec
-
SHA512
8b29099ab473a5a028ba19738adc1cd73d29df65eaf0057d89db160ead6336f7565b576b2f0311db15a75c0f586a07f7b2f1a12b011a53ec717c1ebbce1daa16
-
SSDEEP
1536:rDauc7yPjmzs4McpIwA0+gfHMci0bVr2AzEdINOSbtsrdpysa7iAM1:rDRnc40N/MmbV1zsSOAWrdpYuAe
Malware Config
Extracted
xworm
193.161.193.99:46625
-
Install_directory
%AppData%
-
install_file
Teams.exe
-
telegram
https://api.telegram.org/bot7251026627:AAFe7iqGz4Cd2IluTlmdghq0XQUzAYL6FpY
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Teams.exe
Files
-
Teams.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 64KB - Virtual size: 64KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 108KB - Virtual size: 107KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ