Behavioral task
behavioral1
Sample
0ee209155e17689bea70904f4cb4f546e01ae1824cc7f0f0a29d5c5a8c69d101.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
0ee209155e17689bea70904f4cb4f546e01ae1824cc7f0f0a29d5c5a8c69d101.exe
Resource
win10v2004-20241007-en
General
-
Target
0ee209155e17689bea70904f4cb4f546e01ae1824cc7f0f0a29d5c5a8c69d101
-
Size
67KB
-
MD5
df327ace413f3d7d7096d3691436c8b2
-
SHA1
01062e8125a785b3a345dda2129586f5a6d48581
-
SHA256
0ee209155e17689bea70904f4cb4f546e01ae1824cc7f0f0a29d5c5a8c69d101
-
SHA512
ae24fcaf06217094563b5c8a096259a6afd760c504ea9075419173b0f571cbd5d96afccd737eed9efa5de2e72e8118dfbd379d5e4ca3814a8d47c68a84b00a91
-
SSDEEP
1536:CQKvpn+V+eAIDIjci+JCDNB1Hbo3BjT6hMmOwmNsSkA:Ipfmmci+01Hbo3tmOwm+5A
Malware Config
Extracted
xworm
price-slow.gl.at.ply.gg:28067
-
Install_directory
%AppData%
-
install_file
XClient.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0ee209155e17689bea70904f4cb4f546e01ae1824cc7f0f0a29d5c5a8c69d101
Files
-
0ee209155e17689bea70904f4cb4f546e01ae1824cc7f0f0a29d5c5a8c69d101.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 64KB - Virtual size: 64KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ