General
-
Target
steam.exe
-
Size
344KB
-
MD5
6eb46119234ae9f530f859668a542fb7
-
SHA1
2d6f4653ee3026d0edb3c4ffd3fea6e6a20dca85
-
SHA256
8cb7adde0249669af37f05250c76da9f7b4e3622a2aef2b5d63bba8e143ee2f9
-
SHA512
00e1ecd87a16cf127e676fd543b6c931644c741e1e5aad88300567de4f9990986a2968142277568bc6abb79d6a739318d1c4a6c1e065847c5472483a99bff567
-
SSDEEP
6144:hjbH9rZ2+GIIIIIIIhIIIIIIIIIIIIIIIU:t9rZh
Malware Config
Extracted
xworm
windows-opinions.gl.at.ply.gg:34564
-
Install_directory
%Temp%
-
install_file
steam.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource steam.exe
Files
-
steam.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 78KB - Virtual size: 77KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 265KB - Virtual size: 265KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ