XWorm PE Executable malware analysis – 7a5449da6bd5

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

File

Type

Portable Executable file

Detection

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual C++ 6.0 DLL (Debug)Microsoft Visual C++ 7.0 - 8.0Microsoft Visual C++ v6.0 DLLMicrosoft Visual Studio .NETMicrosoft WAV Audio filePe123 v2006.4.4-4.12PureBasic DLL -> Neil Hodgson

Symbol obfuscation

Medium

2 malicious · 835 files

EXE7a5449da6bd540691171a59a391f2630XWorm

Structure

7Z7z-stream @ 0x0097EFCE.7z

BINResources

BIN.Net Resources

BINXworm.About.resources

BINXworm.ACT.resources

BINXworm.Chat.resources

BINXworm.Clipper.resources

BINXworm.CustomOpen.resources

BINXworm.DDosAttack.resources

BINXworm.EditReg.resources

BINXworm.FilesSearcher.resources

BINXworm.FM.resources

BINXworm.Builder.resources

BINXworm.Clipboard.resources

BINXworm.Hash.resources

BINXworm.HBrowser.resources

BINXworm.Main.resources

BINXworm.HVNC.resources

BINXworm.HApps.resources

BINXworm.Ftp.resources

BINXworm.Fun.resources

BINXworm.Hosts.resources

BINXworm.INFO.resources

BINXworm.Keylogger.resources

BINXworm.Maps.resources

BINXworm.MBox.resources

BINXworm.MIC.resources

BINXworm.ngrok.resources

BINXworm.Performance.resources

BINXworm.Port.resources

BINXworm.ProcessV.resources

BINXworm.Programs.resources

BINXworm.Proxy.resources

BINXworm.Ransomware.resources

BINXworm.Registry.resources

BINXworm.RemoteDesktop.resources

BINXworm.RunPE.resources

BINXworm.ServiceManager.resources

BINXworm.Sound.resources

BINXworm.StartupManager.resources

BINXworm.TBotNotify.resources

BINXworm.TcpConnectionForm.resources

BINXworm.Shell.resources

BINXworm.ToolsBox.resources

BINXworm.TXT.resources

BINXworm.VBCode.resources

BINXworm.VoiceChat.resources

BINXworm.WebCam.resources

7ZXworm.Resources.resourcesXWorm

BINCD

BINChat

BINFolder

BINHDD

BINInformation

BINIntro

BINNetwork

BINPlay

BINQuestion

BINUSB

BINWarning

EXE_7z

EXE_7zD

BIN_Error

BIN_Stop

7Z7z-stream @ 0x001803DA.7z

DLLProtect544cd51a.dll

DLLProtect2a3d628b.dll

BINXworm.HBrowser1.resources

Config. Field	Value
Mutex	abcdefhuhuhuhuhuhuhuhuhuhuhu
SPL	-huhuhuhu
KEY	abcdefhuhuhuhuhuhuhuhuhuhuhu
family	xhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Module Name	XWorm V6.0.exe
Full Name	XWorm V6.0.exe
EntryPoint	System.Void Xworm.My.MyApplication::Main(System.String[])
Scope Name	XWorm V6.0.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	XWorm V6.0
Assembly Version	6.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.5
Total Strings	5426
Main Method	System.Void Xworm.My.MyApplication::Main(System.String[])
Main IL Instruction Count	14
Main IL	nop <null> nop <null> call System.Boolean Microsoft.VisualBasic.ApplicationServices.WindowsFormsApplicationBase::get_UseCompatibleTextRendering() call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) nop <null> leave.s IL_0011: nop nop <null> endfinally <null> nop <null> call Xworm.My.MyApplication Xworm.My.MyProject::get_Application() ldarg.0 <null> callvirt System.Void Microsoft.VisualBasic.ApplicationServices.WindowsFormsApplicationBase::Run(System.String[]) nop <null> ret <null>
Module Name	XWorm V6.0.exe
Full Name	XWorm V6.0.exe
EntryPoint	System.Void Xworm.My.MyApplication::Main(System.String[])
Scope Name	XWorm V6.0.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	XWorm V6.0
Assembly Version	6.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.5
Total Strings	5426
Main Method	System.Void Xworm.My.MyApplication::Main(System.String[])
Main IL Instruction Count	14
Main IL	nop <null> nop <null> call System.Boolean Microsoft.VisualBasic.ApplicationServices.WindowsFormsApplicationBase::get_UseCompatibleTextRendering() call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) nop <null> leave.s IL_0011: nop nop <null> endfinally <null> nop <null> call Xworm.My.MyApplication Xworm.My.MyProject::get_Application() ldarg.0 <null> callvirt System.Void Microsoft.VisualBasic.ApplicationServices.WindowsFormsApplicationBase::Run(System.String[]) nop <null> ret <null>

URLs in VB Code - #1 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #2 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #3 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #4 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #5 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #6 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #7 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #8 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #9 URIsuspect

https:huhuhuhuhuhuhu

URLs in VB Code - #10 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #11 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #12 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

Mutex MUTEXmalicious

abcdefhuhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential