xworm | WizClient[.]bat | Triage

Sharing

General

Target

WizClient.bat
Size

74KB
MD5

597d174e4195961dcf3bdbf7380174e1
SHA1

4085611faa11aa31d87108d34c6a806c7e9c1f38
SHA256

9360c8d65df7517bcc8057c1821f84bc3e66d506fe91067266c1279cf80cd6bd
SHA512

25cc2c5cab623fb2b6069895944af8abfe0d23b4609e876d69bae2a44ba09af681d4ed43c151a0ebb8e2c1e2879ff93f43c55c157d4254a5b2a5b5467883ad05
SSDEEP

1536:IBDmx9OFJIZPop3C5pbIVint26AV1ODqeWKFaHg:I0PwpwpbIVeoV1ODq9K2g

Score

10^/10

xworm

Malware Config

Extracted

Family

xworm

C2

browse-brokers.gl.at.ply.gg:53049

Attributes

Install_directory
%AppData%
install_file
USB.exe

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
sample	family_xworm

Xworm family
xworm

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
WizClient.bat

Files

WizClient.bat
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 71KB - Virtual size: 71KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ