xworm | Stub[.]exe | Triage

Sharing

General

Target

Stub.exe
Size

84KB
MD5

2234544e14c7e54e6f4d186b2fd76895
SHA1

1d093861228c810fd8027ae27a92c7b2e79c606f
SHA256

12d242765341882daf533c354c738074ed726e8e4af92f040d14b5d2ba992d94
SHA512

b7af460b642288f40c0e1491e364959006018da2c2f42e98524da43ec208575a58d0d571a97861f5b1e2c8af844b6a5cc07b802d95abd4163e5d0d0768d813ea
SSDEEP

1536:hUCfdRQM2DT3m/tTfpTGbqESA7fX6q6Rsxnuc8OyUbf2bd:hJPAm3CbqqX6NsN0OyU72d

Score

10^/10

xworm

Malware Config

Extracted

Family

xworm

C2

193.161.193.99:25993

Attributes

Install_directory
%AppData%
install_file
USB.exe

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
sample	family_xworm

Xworm family
xworm

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Stub.exe

Files

Stub.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 81KB - Virtual size: 81KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ