Behavioral task
behavioral1
Sample
autoclicker .exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
autoclicker .exe
Resource
win10v2004-20240226-en
General
-
Target
autoclicker .exe
-
Size
98KB
-
MD5
c7c07e31303ea75977c2c12daa2fff88
-
SHA1
dccb042e07ae6919c482c204782957a3ec2f09f8
-
SHA256
d89325d148717587fdb01767a09ea9aa8b32c2a26a569af4a947fcb0ea4499b3
-
SHA512
b76944004ca10cf9dc3592a0bffca8ac9c599abb3ac986e8ecbcc0ccde9274c364576b746de133fa5b0ab6b5eb15d48676163a2187098fe69107bc0f3b9dcccb
-
SSDEEP
1536:wteMipeYFVpffN8bCEYLg6kxX6OxixPtUcl:KiBFVpd8bCE82xX6O8zd
Malware Config
Extracted
xworm
advertise-located.gl.at.ply.gg:54921
19.ip.gl.ply.gg:54921
XWorm V5.2:123
-
Install_directory
%AppData%
-
install_file
Delta.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource autoclicker .exe
Files
-
autoclicker .exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 64KB - Virtual size: 63KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 33KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ