General
-
Target
nigger.exe
-
Size
62KB
-
MD5
6cffd409d1e3a1a446fae15796f29509
-
SHA1
1b502700dd33751c64da20807e61b2a0dff0a930
-
SHA256
3dae4c211901decdd6381c72f584bea8f0604a954b44d98ac9c406d0e3730d03
-
SHA512
c43130dfe3b25262570e01abb4fe4bfb0825436f093f114a33706174927d39ee3c1048c6fd47e5061730438e9b1776b306a51e60491d2c100a53b6704a373346
-
SSDEEP
1536:IecJgnuA0vUsnTvxT+bRgP3IS6eO4MOY2:rP0vUsnTv9+bRggiO4Ml2
Malware Config
Extracted
xworm
147.185.221.23:19686
-
Install_directory
%AppData%
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource nigger.exe
Files
-
nigger.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 60KB - Virtual size: 59KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ