General
-
Target
B00STER.exe
-
Size
32KB
-
MD5
6352a53ce9d4493c4d2336555a09bdea
-
SHA1
a75e56155755d1927254135327a6e4370cb795be
-
SHA256
1b0f56cacc1925dff17b1f9d404c8b53dc21c7fc420dc885d123764d30d909d0
-
SHA512
27ef2a55cabef395f40552adce921ca91c5af4ad969dee75598f4a075920729fd6dc03144cfd95072abead2e8ecc340ee80b6ef5e3f0529c0d006bff14aa7221
-
SSDEEP
384:4EbmX5Qa+vN1h1+X3v6JFjL+g93Tm2eaFOL1iRApkFTBLTsOZwpGd2v99IkuisDN:9Va+vNtg+PB93Tw4e1iVFE9jGOjhZbY
Malware Config
Extracted
xworm
5.0
127.0.0.1:7777
zQ1HJ92nu9v8rXVy
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource B00STER.exe
Files
-
B00STER.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 30KB - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ