xworm | nursultan crack[.]exe | Triage

Sharing

General

Target

nursultan crack.exe
Size

36KB
MD5

4a39cd1b911d7237d3ad198245501e5a
SHA1

b7eaab3752df42f759d198ea9de719a3c76ffc67
SHA256

7499661b53d56a269ee1ff6817a8449120735f015c16d76f1edb74114f9343a2
SHA512

1627b3e893721c0530aba12a7d93a0ad34ad94ffdc5f5e1ad93b82e245d59cfdb0881de4ae186b9a321ad391984d0ba489dca4881ed45633039c31412da8d871
SSDEEP

768:OTAJM/jPWzJzGMpFALFyn9CUIOjhaD2j:OEsjO1eFU9CHOjt

Score

10^/10

xworm

Malware Config

Extracted

Family

xworm

Version

5.0

C2

remove-woman.gl.at.ply.gg:53860:5915

Mutex

J3OlWpD2zCDTeEld

Attributes

Install_directory
%AppData%
install_file
XClient.exe

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

Processes:

resource yara_rule

sample family_xworm
Xworm family
xworm
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.

Processes:

resource

nursultan crack.exe

Files

nursultan crack.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ