General
-
Target
gamesteal.exe
-
Size
39KB
-
Sample
240328-sbhxxsaa76
-
MD5
fc12f1f12395e8bc187def97c53983ec
-
SHA1
c9ebca9321c038320c7b838fe1059d0c6b05958d
-
SHA256
1cba206f28135b1c0c826b95a3c8479cbb3ffb00de393b7d74589c99db0abeef
-
SHA512
5a98195064b837f8a5fb3d210cb894fab5682066f9e67244cfdf2918437a3ab936579029daa901ebfd4f30adb32f440a2aef07d9a2c4ec8b1d96da22ef185464
-
SSDEEP
768:oNT0Woe2Ntktyd2pwKuukUm2ufFWPt92j6dOMhvalM:oNpo7LIkewKuunsFe92j6dOM1n
Behavioral task
behavioral1
Sample
gamesteal.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
xworm
5.0
daily-retrieved.gl.at.ply.gg:4200
YRFGWIoVsEEZgUB1
-
Install_directory
%Public%
-
install_file
Runtime Broker.exe
Targets
-
-
Target
gamesteal.exe
-
Size
39KB
-
MD5
fc12f1f12395e8bc187def97c53983ec
-
SHA1
c9ebca9321c038320c7b838fe1059d0c6b05958d
-
SHA256
1cba206f28135b1c0c826b95a3c8479cbb3ffb00de393b7d74589c99db0abeef
-
SHA512
5a98195064b837f8a5fb3d210cb894fab5682066f9e67244cfdf2918437a3ab936579029daa901ebfd4f30adb32f440a2aef07d9a2c4ec8b1d96da22ef185464
-
SSDEEP
768:oNT0Woe2Ntktyd2pwKuukUm2ufFWPt92j6dOMhvalM:oNpo7LIkewKuunsFe92j6dOM1n
Score10/10-
Detect Xworm Payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Adds Run key to start application
-