Behavioral task
behavioral1
Sample
xworm.exe
Resource
win7-20241010-en
General
-
Target
xworm.exe
-
Size
36KB
-
MD5
b3a89b0bf85bda317f428c807637f9d5
-
SHA1
99c5f8b888cd29574173ae0f03f6aeebac3ab2e1
-
SHA256
ddfc9420dd7d61ff16c24433bb7bc678301f8fae7842fd1298e3851fd04a912e
-
SHA512
88781bbbfc8e26b61911b47e1b00e03a0cede98f4fe9e77c6ac016e19a7c1c8c5dfe2d0ab6071617b1d5de99cf73fe35be955a83e182f6c7e501906481f1a321
-
SSDEEP
384:fFqouAgAkffHnjuNWoAgLWanS3FLZcWzWCu280wpkFMAfNLT2OZwxcV2v99IkHEy:dzuAinEWaRC4QFm9YtzOMhLkGa
Malware Config
Extracted
xworm
5.0
yXBbU38gyKosDR5d
-
install_file
USB.exe
-
pastebin_url
https://pastebin.com/raw/CKHqQFk6
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource xworm.exe
Files
-
xworm.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 33KB - Virtual size: 33KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ