General
-
Target
Skynet v1.0.2.0.exe
-
Size
81KB
-
MD5
92e3d3d186e5cbb9bdaa88759451ac67
-
SHA1
9bf0f4c9914499403fcbdf7e0b50fa38a0dca399
-
SHA256
467f610762e1f99fb42cc6ca4fe3ba7240e2ca78e551518cffebb7cbc6435699
-
SHA512
ce7d81e6f7e3f008aee1dcf403e5f0e6efdf8095651f3408424465370ad91ca45778eabd2e778b9311e27f8dc4b36f40c594f2ada879b0b4bbb7137e497de710
-
SSDEEP
1536:/Q5LyHKofzhItnymbYfi4FybX1DNEoVaiNhoJG6Icfu8Y5gOYXcYgbi10kc:Uc+bEsbX1Z3aiNkfNegOYXcYgbOBc
Malware Config
Extracted
xworm
127.0.0.1:9999
sell-let.gl.at.ply.gg:9999
-
Install_directory
%AppData%
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Skynet v1.0.2.0.exe
Files
-
Skynet v1.0.2.0.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 79KB - Virtual size: 78KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ