Behavioral task
behavioral1
Sample
robloxcheatss.exe
Resource
win10v2004-20240226-en
General
-
Target
robloxcheatss.exe
-
Size
78KB
-
MD5
3db40c79ef0916b6d7411258875652a7
-
SHA1
7741261406f53e003789e0e914db82866b107503
-
SHA256
d4a23b256d5dfb7fe14f1425ab0e5d472e383930c907a71839242218a27d76db
-
SHA512
56a9d76ed50299dc377de1b7e6504ad0c553b006cc192765515f6a4bbdf671f13048d24e57045102b78e2e4d166a0b6d85956a3a85a41ab2665df7332fb23eaa
-
SSDEEP
1536:ueoSeBwPXXCZ+1dUbdaP5fwV+69bpQzY16KFO7z2Ecp8PlL3:ueY0SEdUdGfwV+69bpyyFO7yEbL3
Malware Config
Extracted
xworm
story-pl.gl.at.ply.gg:5050
-
Install_directory
%Temp%
-
install_file
MicrosoftAudioDriver.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource robloxcheatss.exe
Files
-
robloxcheatss.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 76KB - Virtual size: 75KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ