XWormit[.]rar | Triage™

General

Target
XWormit.rar
Size 69KB
Sample260929-wpbybatwfw
SHA256 8433a74283020fa26e3ae2e3e0ab6caa0753bd914ad88dbebf4133cde5d724c4
MD5 b855a3e3a3ce51be24b8c506bc8b4fad
SHA1 1a0e99a7c0ebc1b97772d625c6d67c1efe1a2937
SHA512 e6a844882b6c11e4770e9bbbd46dc37dea6ec8ac5013a7f085f5283e8c05d7c70acfedcb546e3b0ef2f320895816469d6c02459fb52a31b022bdaef9a875e285
SSDEEP 1536:RrR0cGGtdd6+QQu+sWja7pOyFbdeOWvzPo7mGI75m:MrGtO+QQzSUy2DPrZ75m
TLSH
T1AB6312C00DA4FEA2DF6965E5A0F43BC83A16FC10DDE6A7661130A1655C4ECCFA8436E3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/XWormit.exe

File Explorer

XWormit.rar

.rar 69KB
XWormit.exe

.exe 151KB

XWormit.rar

SHA256 8433a74283020fa26e3ae2e3e0ab6caa0753bd914ad88dbebf4133cde5d724c4
MD5 b855a3e3a3ce51be24b8c506bc8b4fad
SHA1 1a0e99a7c0ebc1b97772d625c6d67c1efe1a2937
SHA512 e6a844882b6c11e4770e9bbbd46dc37dea6ec8ac5013a7f085f5283e8c05d7c70acfedcb546e3b0ef2f320895816469d6c02459fb52a31b022bdaef9a875e285
SSDEEP 1536:RrR0cGGtdd6+QQu+sWja7pOyFbdeOWvzPo7mGI75m:MrGtO+QQzSUy2DPrZ75m
TLSH
T1AB6312C00DA4FEA2DF6965E5A0F43BC83A16FC10DDE6A7661130A1655C4ECCFA8436E3
MD5 SHA1 SHA512 SSDEEP TLSH

XWormit.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 c80c4948fb75fc103b1df755c614c457f506c5186125da2a72e4412ebfd781e2
MD5 85a17dac7091c67b2dfddba1515a9957
SHA1 619c569d63a738eed65188e7c7e1e22b3433cbda
SHA512 37fbd35370c7195f2953254e9ef29a023cd00e4517d2b11d13ccd5c0e63588cd4a098150801054ae8b6a4168bd042f78182069019f1fe38f05f4a9899eeb6d2e
SSDEEP 1536:CABTlnoXi2AP+ew+ksEvCwVwLM+uvpIVyXJyozbGyMqmyVttdGFQeOPigp3dIHyU:DRnMA2ewhLapuvpAsZOyMqmyBeYVYB
TLSH
T1D7E35B65BEDFDDA3F29B29744C698171203C9C6F58F7460711813A8CDBBEAAD0396903
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

21598

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

XWormit.rar

XWormit.exe

mscoree

dotnet

Sharing

General

Malware Config

Signatures

File Explorer

XWormit.rar

XWormit.exe

mscoree

dotnet