Behavioral task
behavioral1
Sample
1528618cb729ad8cd53332e93a75ca4b7b1e2ac2fcbb5a5d33b8bf4ec1740201.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
1528618cb729ad8cd53332e93a75ca4b7b1e2ac2fcbb5a5d33b8bf4ec1740201.exe
Resource
win10v2004-20240802-en
General
-
Target
1528618cb729ad8cd53332e93a75ca4b7b1e2ac2fcbb5a5d33b8bf4ec1740201.exe
-
Size
62KB
-
MD5
33f2e0edb3d56165f186cb8ba0d8346d
-
SHA1
240c5b0fd575ae1218b54f50d8f7b279f1f8958f
-
SHA256
1528618cb729ad8cd53332e93a75ca4b7b1e2ac2fcbb5a5d33b8bf4ec1740201
-
SHA512
18a8bf379160fb850e286b933e37a96b965bd4f61e6260aff3ab01077c8245d6637e772bc5b1e1b0ec44c9c60274150d4fd132950e9885a618c269a61ac69b6b
-
SSDEEP
1536:jdQoncyC0zO9DOvOQuXCDsl+b9mEYzUBrk6PJMVOc6dP9:5b4iOB8jri+b9me17MVOcW9
Malware Config
Extracted
xworm
-
Install_directory
%AppData%
-
install_file
AggeratorHost.exe
-
pastebin_url
https://pastebin.com/raw/9cuDuyiP
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1528618cb729ad8cd53332e93a75ca4b7b1e2ac2fcbb5a5d33b8bf4ec1740201.exe
Files
-
1528618cb729ad8cd53332e93a75ca4b7b1e2ac2fcbb5a5d33b8bf4ec1740201.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 59KB - Virtual size: 59KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ