General
-
Target
gta_betabuild 1.31.zip
-
Size
25KB
-
MD5
427eb31d04d99c162815fbc70a8ddd31
-
SHA1
d8a5aeea0c1e5b37390a46df9cee0143fdbf555a
-
SHA256
0ee5edc4732d5d52527637044a9095878e2bffebe6f39995405ce6165e5a66d9
-
SHA512
45f87ef1f33376905f925c87de93e977dfd1467b349fa5a42b74a3bda571db51d1863301613323b7b445e88465b9a00a8a8e2cbd00f3fdf46d3389e78100d93c
-
SSDEEP
768:dxOfk1ZsqbiWkLRP/Dy0kOswpxOe5+ziNpNFl2o8:dxOfkQqbc/W0awtQYpNFl2L
Malware Config
Extracted
xenorat
37.120.141.155
modtool_gta
-
delay
5000
-
install_path
appdata
-
port
22914
-
startup_name
WinSCVUpdater
Signatures
-
Xenorat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/gta_betabuild 1.31.exe
Files
-
gta_betabuild 1.31.zip.zip
-
gta_betabuild 1.31.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
mscoree
_CorExeMain
Sections
.text Size: 48KB - Virtual size: 48KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ