xworm | kolo[.]exe | Triage

Sharing

General

Target

kolo.exe
Size

71KB
MD5

faea49dfe62bf95884101492dd55b84b
SHA1

124366b77164067458075a639c29564417ad2daf
SHA256

b1c6c20bfeae788fc314d6a7775962632160a0e64b6f4bde0ca51d63a110eb78
SHA512

c1da84e78e87b960fccf1b9ca1a54c75a7767114cff440147a79ec4bb1d09c0e9e69e44f4468d59fed25ad83832a00b619f2699a44d799a800212cfc31bac77c
SSDEEP

1536:5x8Mc+vPtdVKDMBMF5Bw8kbhzeJAC+7OtnN:5GMD3t/KsnzbNMAC4OtN

Score

10^/10

xworm

Malware Config

Extracted

Family

xworm

C2

147.185.221.25:2131

Attributes

install_file
USB.exe

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
sample	family_xworm

Xworm family
xworm

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
kolo.exe

Files

kolo.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ