General
-
Target
softdox.exe
-
Size
62KB
-
MD5
216a09713b0be4a032151d6c22800e24
-
SHA1
0b99ccf06a5926da452bce25b3b6579b9fc035a6
-
SHA256
9f5d315a4636c1fee1f2aeee96ab70da79f2ea36d2d4259f8567f2faac9a63b3
-
SHA512
f3a7ed2bbc2ad077702cb9ac70dbbb7eb4f7bb8aa0d8c6eb9b93054516262a0b9ded22c6711cd07285d6a4f74d9aead334643422365134468d25be5a74902b56
-
SSDEEP
1536:TLDLTy/Ic2/EjhvtjXBubctVsAYd2tY06aGJOa9RR:TiwERmbcEd2tFGJOa9L
Malware Config
Extracted
xworm
127.0.0.1:55437
22.ip.gl.ply.gg:55437
-
Install_directory
%AppData%
-
install_file
fokustool.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource softdox.exe
Files
-
softdox.exe.exe windows:4 windows x86 arch:x86
Password: s1UoiPmzxx
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 60KB - Virtual size: 59KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ