xworm | d076d34daf8420537774816ba2732fc1[.]bin | Triage

Sharing

General

Target

d076d34daf8420537774816ba2732fc1.bin
Size

32KB
MD5

93e05e57fe7c38a13f186a1e394b28f0
SHA1

8c251b1b0aed7d8ceb4b78196f2710865c08a197
SHA256

edba2be4c39c7f376235aaaa0a639daf6dffbb4b7b004be0fa0c7ff39b99a3be
SHA512

91ba289e1a040bf2e33c8b3d7481f9ff2c3b31e254774c7324715c737123a6d8e9d2bf499d8c89e88b466945a9cdb98bef1659793f6e0168ac2805fe8af78e3c
SSDEEP

768:ToXRAPjRCjfqXxOTI1pCNhoZgLE2YA5QyC7h:AAP1UfvI1zyE/tL

Score

10^/10

xworm

Malware Config

Extracted

Family

xworm

C2

127.0.0.1:52794

tcp://tannerdontplay-52794.portmap.host:52794:52794

Attributes

install_file
USB.exe

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
static1/unpack001/3c22272754c28b6a59811b0317095e58411e3341144a7bccdcd38de156b608c6.exe	family_xworm

Xworm family
xworm

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/3c22272754c28b6a59811b0317095e58411e3341144a7bccdcd38de156b608c6.exe

Files

d076d34daf8420537774816ba2732fc1.bin
.zip

Password: infected
3c22272754c28b6a59811b0317095e58411e3341144a7bccdcd38de156b608c6.exe
.exe windows:4 windows x86 arch:x86

Password: infected

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ