Behavioral task
behavioral1
Sample
SteamUDP.exe
Resource
win7-20240419-en
General
-
Target
SteamUDP.exe
-
Size
45KB
-
MD5
71f93439066552063011b27f448fc1ce
-
SHA1
afd983b5d3a34ba29ef18d7675e617b9a6da724f
-
SHA256
5379f50c0b4b3a28641354e048b51278dd10519f50e081a07bbe8f0d4f22a5ad
-
SHA512
ac56596bb93e61d240933353a1d3fd1d5a64dce97e13d381b94190f312ec57be856cd3fdd08c685d6960d734518514b7ecf69284e6371fe8fd96480ae1d76be3
-
SSDEEP
768:9dhO/poiiUcjlJInbzH9Xqk5nWEZ5SbTDa+WI7CPW5w:zw+jjgnXH9XqcnW85SbT/WIY
Malware Config
Extracted
xenorat
37.120.141.155
SteamUDP
-
delay
5000
-
install_path
temp
-
port
22914
-
startup_name
SteamUDPUpdater
Signatures
-
Xenorat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource SteamUDP.exe
Files
-
SteamUDP.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
mscoree
_CorExeMain
Sections
.text Size: 43KB - Virtual size: 42KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ