xworm | allah[.]exe | Triage

Sharing

General

Target

allah.exe
Size

67KB
MD5

801bcacf5ee72a5871d43db2bbe67c5b
SHA1

8e8820be0eac81b28b1c56c091511c31a872e045
SHA256

d1fa0a10d83aeb69a4142815522c9ddd6b74dd761661ff60e169b58439098b0c
SHA512

2e145f53af0d1922f16bb09666ab2d1355fdbd418559c758e72e642614514f0635847e34d588d992d5999cd17230ad4d248bfc4e04fe36379ffccc5fbeed3065
SSDEEP

1536:hh8tOfil285SO6XSfQJWJbiW+bz1CgLCy2sm1OQIEQMPeSw:QtOS2u4JWNiW+bz1CtOtpbT

Score

10^/10

xworm

Malware Config

Extracted

Family

xworm

C2

poker-dosage.gl.at.ply.gg:10021

Attributes

Install_directory
%AppData%
install_file
RealtekUService86.exe

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
sample	family_xworm

Xworm family
xworm

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
allah.exe

Files

allah.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 64KB - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ