Behavioral task
behavioral1
Sample
9a63a14144f2bbaf883b43c46901542175d8dd2307b73f5ebb093862956ec623N.exe
Resource
win7-20241010-en
General
-
Target
9a63a14144f2bbaf883b43c46901542175d8dd2307b73f5ebb093862956ec623N
-
Size
46KB
-
MD5
54fa6eae2fb6549957db7394336bca10
-
SHA1
7bbcbe664d21783ad0cd1b6122769a5f190e0dd9
-
SHA256
9a63a14144f2bbaf883b43c46901542175d8dd2307b73f5ebb093862956ec623
-
SHA512
67ee16402021257455a40024eded654e70a3e911c453333c9a8a2453a1d775542587c22e8f158656fac7cbd5f9c1dc37bcb3002849a9ff0f3c582c636b152627
-
SSDEEP
768:a0RbMun94y2fpX8BbmNm0Y/QL/r8bWgWzL4moXMnkbAj43/odKbD8O7h8SjvgC:3bMun94y2fSBbmYj/Q3aYr1kbAj43CKx
Malware Config
Extracted
xworm
127.0.0.1:7777
leave-ages.gl.at.ply.gg:7777
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9a63a14144f2bbaf883b43c46901542175d8dd2307b73f5ebb093862956ec623N
Files
-
9a63a14144f2bbaf883b43c46901542175d8dd2307b73f5ebb093862956ec623N.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 44KB - Virtual size: 43KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ