xworm | e03c1771945c884883a82704a93ca453[.]bin | Triage

Sharing

General

Target

e03c1771945c884883a82704a93ca453.bin
Size

116KB
MD5

cadfcf7a0163f26bb2d54c98c02b2c81
SHA1

5c911bea7a35f1a942c9e0fa2b549ba843d6f35d
SHA256

cce1ff065d5401679f060d6daa0de21c639f744f7ef6398578201c92d62c1154
SHA512

5bb1d19de38e04e0af3d94508fa24178b6600dfa604a2ed21466ee9b30f5dfd71cffc07a371ab1403a20aacff6beb7fc5952b2bc0a285feec5d566c697c70a79
SSDEEP

3072:xFbXqyIWsty7bfyzz/tjtoQsP0Fnqc29CV:x5Xq+tnKzpyNP0Fn92YV

Score

10^/10

xworm

Malware Config

Extracted

Family

xworm

C2

23.ip.gl.ply.gg:7972

Attributes

Install_directory
%AppData%
install_file
svchost.exe

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
static1/unpack001/53ffbe2e9c08961a21157be3a79fe0a33d19ec4bdae8cf2dc62c27f1fa4097df.exe	family_xworm

Xworm family
xworm

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/53ffbe2e9c08961a21157be3a79fe0a33d19ec4bdae8cf2dc62c27f1fa4097df.exe

Files

e03c1771945c884883a82704a93ca453.bin
.zip

Password: infected
53ffbe2e9c08961a21157be3a79fe0a33d19ec4bdae8cf2dc62c27f1fa4097df.exe
.exe windows:4 windows x86 arch:x86

Password: infected

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 51KB - Virtual size: 51KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 202KB - Virtual size: 202KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ