Behavioral task
behavioral1
Sample
c29c2c7ce19d21b061526c245a2ad74fe438234e859d643f42b56b65fa9f5d87N.exe
Resource
win7-20240708-en
General
-
Target
c29c2c7ce19d21b061526c245a2ad74fe438234e859d643f42b56b65fa9f5d87N
-
Size
79KB
-
MD5
a79d6693739e5d03340b87304f8d63b0
-
SHA1
92eb66899b10b210ccb0793b88c1ad0d14f66498
-
SHA256
c29c2c7ce19d21b061526c245a2ad74fe438234e859d643f42b56b65fa9f5d87
-
SHA512
9ef415f5fa9af1a9d4ddb8ac9ebe6a24bd2203f3369474b40d2479c2adc10a4c59663416b58f18f35787ba4bae9f4fa7ea3b681c841b6458637c6b877b6bfe15
-
SSDEEP
1536:/14Qr2GY6Czn3B+aPAJj0LIiSbTbwsgyE+CRN6Y6O/aHuzp:/jrFoH+jAgTbw8E+CRoO/a2p
Malware Config
Extracted
xworm
often-objectives.gl.at.ply.gg:59370
-
Install_directory
%AppData%
-
install_file
XClient.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c29c2c7ce19d21b061526c245a2ad74fe438234e859d643f42b56b65fa9f5d87N
Files
-
c29c2c7ce19d21b061526c245a2ad74fe438234e859d643f42b56b65fa9f5d87N.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 77KB - Virtual size: 76KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ