Behavioral task
behavioral1
Sample
RobloxHelper.exe
Resource
win7-20240221-en
General
-
Target
RobloxHelper.exe
-
Size
67KB
-
MD5
7a082dad2399c91b436d12a4cbb4fbee
-
SHA1
f88682cca80e472eec683123b67f229e322cd634
-
SHA256
9ea3c29b210f11fc542c13e49f0a31c84962927b67f75f810a6bf416a7591ddd
-
SHA512
3497b0ab659d57a459cd0736b847a7951f02dcd52bb499f686cd0e4e8aae4e6123b17a4ba6e71a3756636eb60ee39ebed239a884634f9cfe857a4f87a469302a
-
SSDEEP
1536:eTg/EN+Pa0O+T+b7M4PDTEWt6xJgO+3rBJ:eD+P2y+b7MKfEWnO+9J
Malware Config
Extracted
xworm
bay-cf.gl.at.ply.gg:20819:20819
188.254.126.46:20819
-
Install_directory
%AppData%
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource RobloxHelper.exe
Files
-
RobloxHelper.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 64KB - Virtual size: 64KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ