Behavioral task
behavioral1
Sample
island.exe
Resource
win11-20240802-en
General
-
Target
island.exe
-
Size
241KB
-
MD5
6c8f9060de5c7573301f922bb0a93c0b
-
SHA1
4b343387112a6a7f4705b7e9bc246d51dc371e3c
-
SHA256
570380961c528645d75a903f205ca52bbca6b2bbd5e7ee4706ca2c1210591157
-
SHA512
57b53b7587568f587a289809214446e456e68b1302955ef7e2537256500251422045d8499f3d044dcbee8e3a579e53ac6e96dc2fd0eb76244a05195a1c822ff5
-
SSDEEP
6144:I2yPi20ZfOqbG84aUhcX7elbKTua9bfF/H9d9n:I24iDZ2Na3X3u+
Malware Config
Extracted
xworm
zip-connection.gl.at.ply.gg:33171
-
Install_directory
%AppData%
-
install_file
XClient.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource island.exe
Files
-
island.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 74KB - Virtual size: 73KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 166KB - Virtual size: 166KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ