Behavioral task
behavioral1
Sample
XWorm V5.6.exe
Resource
win11-20240802-en
General
-
Target
XWorm V5.6.exe
-
Size
225KB
-
MD5
cd33f6b2d486b8ec8e92c9da206b8931
-
SHA1
17189ccb9652b0359261ed50dbe7f6e8d327dd77
-
SHA256
05a8466eaf6b9c634d00a1a381c15d9be94a9298d606bb87b07408a7e59a296d
-
SHA512
f6e8a8f8fb9bc97f8eb0d83cc9c1df94f79bc46b87be2c2283e99468eccef591e3c8aa51c4a79d1b9cffbd0341036fd88881d917718fda38b852d0cb56e9b7dc
-
SSDEEP
3072:UAXAKEzo1A+bXbVheQvXqBL4ORl7VSzA2ewhLapuvpAsZOyMqmyBeYVYS:UATEc3XbHFOLjLSB/GWGwqqm1
Malware Config
Extracted
xworm
else-treatment.gl.at.ply.gg:31932
-
Install_directory
%AppData%
-
install_file
XClient.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource XWorm V5.6.exe
Files
-
XWorm V5.6.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 87KB - Virtual size: 87KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 137KB - Virtual size: 136KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ