xworm | 241002-pcc7aasc5k_pw_infected[.]zip | Triage

Sharing

Copy URL Twitter E-mail

General

Target

241002-pcc7aasc5k_pw_infected.zip
Size

16KB
MD5

93b8970364102d8659022cd9467375a0
SHA1

59a7fd9af57d55b7108471ddc4c857e2df3e0884
SHA256

fc043af6382b61423b1e274b6052af41096b6856b00b7fea4827e409f6e03fb0
SHA512

966026efe0f94bc41adf2e7c9b44159379af22c8c0df9e001b776c3e33c62b046c1443c227480ece2d67d3b8fc0f779d68d413a4d21c71c450de5235d187df71
SSDEEP

384:k/ZZd+oE5CxQABS4M1/fhCahkmbKIpgBy6q8K:ajcoEIQABFM1pCyGIOBy6s

Score

10^/10

xworm

Malware Config

Extracted

Family

xworm

Version

5.0

C2

ziadonfire.work.gd:7000

Mutex

rZ2W67345HrmrYRB

Attributes

install_file
USB.exe

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
static1/unpack001/92baa79ed1e8ccca07666968715b1d517c9e7340505112b41aadef1e7e433a1c	family_xworm

Xworm family
xworm

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/92baa79ed1e8ccca07666968715b1d517c9e7340505112b41aadef1e7e433a1c

Files

241002-pcc7aasc5k_pw_infected.zip
.zip

Password: infected
92baa79ed1e8ccca07666968715b1d517c9e7340505112b41aadef1e7e433a1c
.exe windows:4 windows x86 arch:x86

Password: infected

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ