Behavioral task
behavioral1
Sample
Sp00fer Crack.exe
Resource
win10v2004-20240508-en
General
-
Target
Sp00fer Crack.rar
-
Size
20KB
-
MD5
9f801def38ba224398717c90afba8a1a
-
SHA1
699054d24eee73bbe23cfd5e2dc81f965114e262
-
SHA256
15ec7a3b5c0023308b40e74a8827740ea91d468d2d7cfc3fa82f1f7248265114
-
SHA512
c24d9f15b22da434974cef724e5796450cafbaaa9bb561e92a9160de3203f7246c71198f5f48183bfbb07e0e4067c7ecb0aa95be79c2919a9bb107b49142d14a
-
SSDEEP
384:0Vo/koDWDnyYBU4PTpkCKsu2kFEY11R9iX4WgvWlsVQFOIzH0QZt8nIN1r0i2AtQ:0Vz2UNBU8VHfkFuI5vWliQFTzjt8m1rO
Malware Config
Extracted
xworm
5.0
6.tcp.eu.ngrok.io:18743
jKE9ZDYBRmujJC3R
-
Install_directory
%AppData%
-
install_file
sp.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule static1/unpack001/Sp00fer Crack.exe family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Sp00fer Crack.exe
Files
-
Sp00fer Crack.rar.rar
-
Sp00fer Crack.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 43KB - Virtual size: 42KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ