Behavioral task
behavioral1
Sample
2024-08-19_2ebb19e143ad423ea0782e0f9da24e26_hiddentear.exe
Resource
win7-20240708-en
General
-
Target
2024-08-19_2ebb19e143ad423ea0782e0f9da24e26_hiddentear
-
Size
190KB
-
MD5
2ebb19e143ad423ea0782e0f9da24e26
-
SHA1
5989e89520c90d88d8c0cbd33bbace194e84d4c2
-
SHA256
b2582bbe4d778445364ce54d2fd664868b7c917c3e4bac69b33b2219a7844aec
-
SHA512
2b6b91f933ae3976ed997a91b2a9653e2bec56bda2b4717f0a4fb68a17f87c509d67b9aa21c9f88c7aecd01d932dafbfce1ce935ea46ae3f32d40dde4d15d84c
-
SSDEEP
3072:uNFhLLExdtORgbsZn6F24NXCePOx+EzizM+lmsolAIrRuw+mqv9j1MWLQm:uBwdURgbK6F24NX9QtzB+lDAA
Malware Config
Extracted
xworm
176.10.111.14:60444
-
Install_directory
%AppData%
-
install_file
Xapp.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-08-19_2ebb19e143ad423ea0782e0f9da24e26_hiddentear
Files
-
2024-08-19_2ebb19e143ad423ea0782e0f9da24e26_hiddentear.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 90KB - Virtual size: 89KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 99KB - Virtual size: 98KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ