ff8d4e85afc851f980f7227ebfddcabf75926a6306d4355b1062f0070141c8eb.zip
- SHA256 c5e92d277b87479546c2416b61ae27ed9aebf286fd7a9bdc5ad6afacfe2579d1
Password
infected
General
- Target ff8d4e85afc851f980f7227ebfddcabf75926a6306d4355b1062f0070141c8eb.zip
- Size 17KB
- Sample261008-aftacaf17z
- SHA256 c5e92d277b87479546c2416b61ae27ed9aebf286fd7a9bdc5ad6afacfe2579d1
- MD5 35f64880b0520336f5ab1533bba074d3
- SHA1 5395190daf07c611fcb1964cfbefe8e8c655825a
- SHA512 9c2c40ac2707ee26c8ca0796b9908dee0fe698ce15ea8653d81a4c01b1a2befec825ea8f242802c3987076a4425b09874f722bbd482df6b86d4128bd71a84007
- SSDEEP 384:NU3jDEUrw7tqD90RWzbBGdCqWyXSlYzEzt4ApmRJ0KjJ3G+XZ02RytzJLii:NmVw7tiKRW3B4CdYzStvpmRJ0Kt3GCti
- TLSH T10182C0841B08F81BD84F9179A42BC991AEDD6334F66EEF6242764B8F4DCB8101C2DB54
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
xworm
Version
-
5.0
C2
-
151.241.154.23:7007
Mutex
-
kvQXfutAWZiVID40
Attributes
-
install_file
USB.exe
aes.plain
Signatures
- Detect Xworm Payload 1 IoCs
resource yara_rule static1/unpack001/ff8d4e85afc851f980f7227ebfddcabf75926a6306d4355b1062f0070141c8eb.exe family_xworm - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/ff8d4e85afc851f980f7227ebfddcabf75926a6306d4355b1062f0070141c8eb.exe
File Explorer
-
ff8d4e85afc851f980f7227ebfddcabf75926a6306d4355b1062f0070141c8eb.zip.zip 17KB
-
ff8d4e85afc851f980f7227ebfddcabf75926a6306d4355b1062f0070141c8eb.exe.exe 36KB
ff8d4e85afc851f980f7227ebfddcabf75926a6306d4355b1062f0070141c8eb.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 ff8d4e85afc851f980f7227ebfddcabf75926a6306d4355b1062f0070141c8eb
- MD5 4c3747305b868bc35cdc0c06783c2414
- SHA1 ea45acf7b04e2c0c2e350bbe6eec7e949b16ea16
- SHA512 09abbdaac7b97b0070676632468508abc79348ec8b45fd9b9159c835a39cdf1e0de30a89a3781523479b296bd177fe6be6e719d813b4b1f32618e15cc2d02d21
- SSDEEP 768:sLJau6SW06XPdxcOMqbFJ9YRaOMhr3xzC:slautWzXFVMuFJ9YRaOMdZC
- TLSH T119F24D083BD44225D6FF7FFA59B371021670F9079913EB8D4CD89AAA6F27BC045143AA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detect Xworm Payload
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
4
Entry point
42350
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
33KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ