Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
SilverX.exe
-
Size
200KB
-
MD5
85611717773ecdbb940b47dd578d6d72
-
SHA1
e530d3944267ed11a0cd5268a9292711944c80a5
-
SHA256
2f5f9e2f38f97223d49ae4963dc784a85267bb28ab58608037fc2966044e382e
-
SHA512
83c741b22d63292205353995643ebbe431b585f9bb8bf69562ab60afa15851260162c933bde436a4024f53eac8a9d0fda1a07f510078cb7fe0f2f24a8e1c6d87
-
SSDEEP
1536:WhjHGD/AjWYonzgylm/KZ+bh9BKyBEoBsOa31P0hnTQPQlFr89OHpqp8DblJ79A5:rDo2ns/KZ+bhey1sOa31MhcPQ5C
Malware Config
Extracted
xworm
127.0.0.1:8848
-
Install_directory
%AppData%
-
install_file
SilverX.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource SilverX.exe
Files
-
SilverX.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 65KB - Virtual size: 64KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 134KB - Virtual size: 134KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ