xworm | dady fuck me[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
dady fuck me.exe
Size 60KB
Sample250308-3bsr8strv2
SHA256 f21dd32ced36cfbf193d41c52d4e893678ed26d5207a21febdec24b0b956ce70
MD5 3d737c8e5845d40e00f11006b3972f4a
SHA1 2cb58ff50cdf3c7a6df6966d118b0d74e953d1db
SHA512 0e09463945147d2fe383d99596ed9234e10c9bd6733cf2b024164dc64a029dc07cb1c835b0aa7f0c1ee1ce3f03f11a75e3ab3667fb87f97e7e57e14b26c03283
SSDEEP 1536:hf7Iampgg+ABDe1agVvABNb2GIGnyDoxNj3OPw7:hf7MgdA1CtVcNb2cP3OPw7
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xworm

Malware Config

Extracted

Family

xworm

C2

homes-customized.gl.at.ply.gg:49855

Attributes

Install_directory
%AppData%
install_file
XClient.exe

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
sample	family_xworm

Xworm family
xworm

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dady fuck me.exe

File Explorer

dady fuck me.exe

.exe 60KB

dady fuck me.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 f21dd32ced36cfbf193d41c52d4e893678ed26d5207a21febdec24b0b956ce70
MD5 3d737c8e5845d40e00f11006b3972f4a
SHA1 2cb58ff50cdf3c7a6df6966d118b0d74e953d1db
SHA512 0e09463945147d2fe383d99596ed9234e10c9bd6733cf2b024164dc64a029dc07cb1c835b0aa7f0c1ee1ce3f03f11a75e3ab3667fb87f97e7e57e14b26c03283
SSDEEP 1536:hf7Iampgg+ABDe1agVvABNb2GIGnyDoxNj3OPw7:hf7MgdA1CtVcNb2cP3OPw7
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Detect Xworm Payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

67486

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths