General
-
Target
1.exe
-
Size
32KB
-
MD5
5bf13242d59c354fc72e4047efa3320f
-
SHA1
9e925edcac6abe9d5523fc2771d429858099502b
-
SHA256
cdbecea88d7be91ae292e77afd68f45b8d4c037e03146d8e710f3cb33b1a0af5
-
SHA512
1986a66a0424695eb2fd39de50b093a644b946b59ac1fe688faac38afa8b9fa43ddd269217d755fb753f5de6b913087bc452357e289093c41dc797afdf77d82b
-
SSDEEP
384:0r8WqVDweYXS3ghk3wcD6LxNUiYnM2M4dm5wR+ptFFBLTiZw/W+UvK9Ikn1lTHxV:qiedxNUdnM2M4oOcFz9LdOjh2/pv5N
Malware Config
Extracted
xworm
loss-zero.gl.at.ply.gg:10682
scst44sS3DKOlfYM
-
Install_directory
%AppData%
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1.exe
Files
-
1.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 29KB - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ