a10f6df054468259fecef130cc3257dd

PE Executable
|
MD5: a10f6df054468259fecef130cc3257dd
|
Size: 49.66 KB
|
application/x-dosexec

Infection Chain

Summary by MalvaGPT

Characteristics

Hash	Hash Value
MD5	a10f6df054468259fecef130cc3257dd
Sha1	5280618f8090576446695fe8905ed54aae851fdc
Sha256	32bd0facd51f470e833edf85d93e2c36e90e2ff7824c981d795950d92663cd05
Sha384	4433e9a293ac70325255da77242ffc31e58546855ea86e8a229759a9410147c986fe2f2544a85826464e8223087acc36
Sha512	88f3c9895cfab6a7c60019d7e3d23d770bfaea1b33674bcfb7826917abd596ab87426ae3231c24dd132dc3e69f46b97de2340b9a870d0f17da20609bb86aec36
SSDeep	768:pHuYQ0iNF2qTg/iXGuSmiDsdJ8DqigkbpMREFA+AcvONSLOChTztb:pOQp22iXGVjDO8+pkbpoqA+AcGeOCjb
TLSH	71236C1877B68127D5FE9FF01CF26112D275A6139913DB5F28D841CB2B13ACC8A922F6

PeID

.NET executable

Microsoft Visual C# / Basic .NET

Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL

Microsoft Visual C# v7.0 / Basic .NET

Microsoft Visual Studio .NET

File Structure

Malware Configuration - XWorm config.

Config. Field0	Value
Mutex	Hsa9YhAOjTdlsYWl
Hosts	127.0.0.1,akea-44005.portmap.host
Port	44005
KEY	<123456789>
USBNM	<Xwormmm>
family	xworm

Informations

Name0	Value
Info	PE Detect: PeReader OK (file layout)
Module Name	XClient.exe
Full Name	XClient.exe
EntryPoint	System.Void Stub.WsVYLpr0bPTdmXCRZDqGFm94Ov6h0j89TRKsV::LsxfYzHsSwUsn3MBVpuNhFW3ohSvkiBNPci2H()
Scope Name	XClient.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	XClient
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	<null>
Total Strings	237
Main Method	System.Void Stub.WsVYLpr0bPTdmXCRZDqGFm94Ov6h0j89TRKsV::LsxfYzHsSwUsn3MBVpuNhFW3ohSvkiBNPci2H()
Main IL Instruction Count	58
Main IL	ldsfld System.Int32 AfmpjNb8OZIXTZgvUsJUqLx7jjXeDv2yOjfLZ::es7PR6GL52ISmlS4bFPs8ENi7IqoQO60lCWuz ldc.i4 1000 mul.ovf <null> call System.Void System.Threading.Thread::Sleep(System.Int32) ldsfld System.String AfmpjNb8OZIXTZgvUsJUqLx7jjXeDv2yOjfLZ::3FtcZFZO9UshgRsTx9wkqpvYvJZYMyIfmr1kV call System.Object Stub.o0KRi8B1dFxrGKL28cOwU1xoVdA6DJaHJMbO2::fPbFKvtzS2qz6WZLFqiqCLO0X3LDBvL14Ufoc(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String AfmpjNb8OZIXTZgvUsJUqLx7jjXeDv2yOjfLZ::3FtcZFZO9UshgRsTx9wkqpvYvJZYMyIfmr1kV ldsfld System.String AfmpjNb8OZIXTZgvUsJUqLx7jjXeDv2yOjfLZ::BIDiEIZ9v3HhdGvz8RVa4LkdawfM662fD7Je1 call System.Object Stub.o0KRi8B1dFxrGKL28cOwU1xoVdA6DJaHJMbO2::fPbFKvtzS2qz6WZLFqiqCLO0X3LDBvL14Ufoc(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String AfmpjNb8OZIXTZgvUsJUqLx7jjXeDv2yOjfLZ::BIDiEIZ9v3HhdGvz8RVa4LkdawfM662fD7Je1 ldsfld System.String AfmpjNb8OZIXTZgvUsJUqLx7jjXeDv2yOjfLZ::X1bUjvxoq5JKXrwC4hkQk7ICkclizWIEqO5Xc call System.Object Stub.o0KRi8B1dFxrGKL28cOwU1xoVdA6DJaHJMbO2::fPbFKvtzS2qz6WZLFqiqCLO0X3LDBvL14Ufoc(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String AfmpjNb8OZIXTZgvUsJUqLx7jjXeDv2yOjfLZ::X1bUjvxoq5JKXrwC4hkQk7ICkclizWIEqO5Xc ldsfld System.String AfmpjNb8OZIXTZgvUsJUqLx7jjXeDv2yOjfLZ::7D5UkxRmVBSrOU6luhpyVN7dWrjPa6iBdJCL1 call System.Object Stub.o0KRi8B1dFxrGKL28cOwU1xoVdA6DJaHJMbO2::fPbFKvtzS2qz6WZLFqiqCLO0X3LDBvL14Ufoc(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String AfmpjNb8OZIXTZgvUsJUqLx7jjXeDv2yOjfLZ::7D5UkxRmVBSrOU6luhpyVN7dWrjPa6iBdJCL1 ldsfld System.String AfmpjNb8OZIXTZgvUsJUqLx7jjXeDv2yOjfLZ::yzKA8tIR4rPUPOk9H9y9IeVGr32kw8yhxF3Dg call System.Object Stub.o0KRi8B1dFxrGKL28cOwU1xoVdA6DJaHJMbO2::fPbFKvtzS2qz6WZLFqiqCLO0X3LDBvL14Ufoc(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String AfmpjNb8OZIXTZgvUsJUqLx7jjXeDv2yOjfLZ::yzKA8tIR4rPUPOk9H9y9IeVGr32kw8yhxF3Dg ldsfld System.String AfmpjNb8OZIXTZgvUsJUqLx7jjXeDv2yOjfLZ::Xqu2PKyGJcIgpSlY5x35BkauGKZ8XPgi5Vf4r call System.Object Stub.o0KRi8B1dFxrGKL28cOwU1xoVdA6DJaHJMbO2::fPbFKvtzS2qz6WZLFqiqCLO0X3LDBvL14Ufoc(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String AfmpjNb8OZIXTZgvUsJUqLx7jjXeDv2yOjfLZ::Xqu2PKyGJcIgpSlY5x35BkauGKZ8XPgi5Vf4r leave.s IL_009E: call System.Boolean Stub.LOUYjt70vdHKqsji4JIS0sXsaoUUKANPqBC9N::P8b7NI2EANx1chDH7a3zth7bDm7yYyZLsaJCB() dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.2 <null> ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_009E: call System.Boolean Stub.LOUYjt70vdHKqsji4JIS0sXsaoUUKANPqBC9N::P8b7NI2EANx1chDH7a3zth7bDm7yYyZLsaJCB() call System.Boolean Stub.LOUYjt70vdHKqsji4JIS0sXsaoUUKANPqBC9N::P8b7NI2EANx1chDH7a3zth7bDm7yYyZLsaJCB() brtrue.s IL_00AB: call System.Void Stub.LOUYjt70vdHKqsji4JIS0sXsaoUUKANPqBC9N::OOlByUOq8bIFbVl9yJXlAOCbuDVgTStTov6Et() ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) call System.Void Stub.LOUYjt70vdHKqsji4JIS0sXsaoUUKANPqBC9N::OOlByUOq8bIFbVl9yJXlAOCbuDVgTStTov6Et() ldnull <null> ldftn System.Void Stub.WsVYLpr0bPTdmXCRZDqGFm94Ov6h0j89TRKsV::xBXiDjJFb8sm1o5Jd46Dz5xfMy1B0d05p7aAD() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.0 <null> ldnull <null> ldftn System.Void Stub.WsVYLpr0bPTdmXCRZDqGFm94Ov6h0j89TRKsV::HqkNkCdMz2Pl4xEygolmQBNH2zJz2XHg0dpMH() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.1 <null> ldloc.0 <null> callvirt System.Void System.Threading.Thread::Start() ldloc.1 <null> callvirt System.Void System.Threading.Thread::Start() ldloc.1 <null> callvirt System.Void System.Threading.Thread::Join() ret <null>
Module Name	XClient.exe
Full Name	XClient.exe
EntryPoint	System.Void Stub.WsVYLpr0bPTdmXCRZDqGFm94Ov6h0j89TRKsV::LsxfYzHsSwUsn3MBVpuNhFW3ohSvkiBNPci2H()
Scope Name	XClient.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	XClient
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	<null>
Total Strings	237
Main Method	System.Void Stub.WsVYLpr0bPTdmXCRZDqGFm94Ov6h0j89TRKsV::LsxfYzHsSwUsn3MBVpuNhFW3ohSvkiBNPci2H()
Main IL Instruction Count	58
Main IL	ldsfld System.Int32 AfmpjNb8OZIXTZgvUsJUqLx7jjXeDv2yOjfLZ::es7PR6GL52ISmlS4bFPs8ENi7IqoQO60lCWuz ldc.i4 1000 mul.ovf <null> call System.Void System.Threading.Thread::Sleep(System.Int32) ldsfld System.String AfmpjNb8OZIXTZgvUsJUqLx7jjXeDv2yOjfLZ::3FtcZFZO9UshgRsTx9wkqpvYvJZYMyIfmr1kV call System.Object Stub.o0KRi8B1dFxrGKL28cOwU1xoVdA6DJaHJMbO2::fPbFKvtzS2qz6WZLFqiqCLO0X3LDBvL14Ufoc(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String AfmpjNb8OZIXTZgvUsJUqLx7jjXeDv2yOjfLZ::3FtcZFZO9UshgRsTx9wkqpvYvJZYMyIfmr1kV ldsfld System.String AfmpjNb8OZIXTZgvUsJUqLx7jjXeDv2yOjfLZ::BIDiEIZ9v3HhdGvz8RVa4LkdawfM662fD7Je1 call System.Object Stub.o0KRi8B1dFxrGKL28cOwU1xoVdA6DJaHJMbO2::fPbFKvtzS2qz6WZLFqiqCLO0X3LDBvL14Ufoc(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String AfmpjNb8OZIXTZgvUsJUqLx7jjXeDv2yOjfLZ::BIDiEIZ9v3HhdGvz8RVa4LkdawfM662fD7Je1 ldsfld System.String AfmpjNb8OZIXTZgvUsJUqLx7jjXeDv2yOjfLZ::X1bUjvxoq5JKXrwC4hkQk7ICkclizWIEqO5Xc call System.Object Stub.o0KRi8B1dFxrGKL28cOwU1xoVdA6DJaHJMbO2::fPbFKvtzS2qz6WZLFqiqCLO0X3LDBvL14Ufoc(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String AfmpjNb8OZIXTZgvUsJUqLx7jjXeDv2yOjfLZ::X1bUjvxoq5JKXrwC4hkQk7ICkclizWIEqO5Xc ldsfld System.String AfmpjNb8OZIXTZgvUsJUqLx7jjXeDv2yOjfLZ::7D5UkxRmVBSrOU6luhpyVN7dWrjPa6iBdJCL1 call System.Object Stub.o0KRi8B1dFxrGKL28cOwU1xoVdA6DJaHJMbO2::fPbFKvtzS2qz6WZLFqiqCLO0X3LDBvL14Ufoc(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String AfmpjNb8OZIXTZgvUsJUqLx7jjXeDv2yOjfLZ::7D5UkxRmVBSrOU6luhpyVN7dWrjPa6iBdJCL1 ldsfld System.String AfmpjNb8OZIXTZgvUsJUqLx7jjXeDv2yOjfLZ::yzKA8tIR4rPUPOk9H9y9IeVGr32kw8yhxF3Dg call System.Object Stub.o0KRi8B1dFxrGKL28cOwU1xoVdA6DJaHJMbO2::fPbFKvtzS2qz6WZLFqiqCLO0X3LDBvL14Ufoc(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String AfmpjNb8OZIXTZgvUsJUqLx7jjXeDv2yOjfLZ::yzKA8tIR4rPUPOk9H9y9IeVGr32kw8yhxF3Dg ldsfld System.String AfmpjNb8OZIXTZgvUsJUqLx7jjXeDv2yOjfLZ::Xqu2PKyGJcIgpSlY5x35BkauGKZ8XPgi5Vf4r call System.Object Stub.o0KRi8B1dFxrGKL28cOwU1xoVdA6DJaHJMbO2::fPbFKvtzS2qz6WZLFqiqCLO0X3LDBvL14Ufoc(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String AfmpjNb8OZIXTZgvUsJUqLx7jjXeDv2yOjfLZ::Xqu2PKyGJcIgpSlY5x35BkauGKZ8XPgi5Vf4r leave.s IL_009E: call System.Boolean Stub.LOUYjt70vdHKqsji4JIS0sXsaoUUKANPqBC9N::P8b7NI2EANx1chDH7a3zth7bDm7yYyZLsaJCB() dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.2 <null> ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_009E: call System.Boolean Stub.LOUYjt70vdHKqsji4JIS0sXsaoUUKANPqBC9N::P8b7NI2EANx1chDH7a3zth7bDm7yYyZLsaJCB() call System.Boolean Stub.LOUYjt70vdHKqsji4JIS0sXsaoUUKANPqBC9N::P8b7NI2EANx1chDH7a3zth7bDm7yYyZLsaJCB() brtrue.s IL_00AB: call System.Void Stub.LOUYjt70vdHKqsji4JIS0sXsaoUUKANPqBC9N::OOlByUOq8bIFbVl9yJXlAOCbuDVgTStTov6Et() ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) call System.Void Stub.LOUYjt70vdHKqsji4JIS0sXsaoUUKANPqBC9N::OOlByUOq8bIFbVl9yJXlAOCbuDVgTStTov6Et() ldnull <null> ldftn System.Void Stub.WsVYLpr0bPTdmXCRZDqGFm94Ov6h0j89TRKsV::xBXiDjJFb8sm1o5Jd46Dz5xfMy1B0d05p7aAD() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.0 <null> ldnull <null> ldftn System.Void Stub.WsVYLpr0bPTdmXCRZDqGFm94Ov6h0j89TRKsV::HqkNkCdMz2Pl4xEygolmQBNH2zJz2XHg0dpMH() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.1 <null> ldloc.0 <null> callvirt System.Void System.Threading.Thread::Start() ldloc.1 <null> callvirt System.Void System.Threading.Thread::Start() ldloc.1 <null> callvirt System.Void System.Threading.Thread::Join() ret <null>

Artefacts

Name0	Value
Mutex	Hsa9YhAOjTdlsYWl
CnC	127.0.0.1
CnC	akea-44005.portmap.host
Port	44005

a10f6df054468259fecef130cc3257dd (49.66 KB)