General

  • Target

    Nursultan_1.16.5.zip

  • Size

    91KB

  • MD5

    50ef51b146fdf4428f35ecfd7208dc67

  • SHA1

    8d86b12cfaa4bd1dc6b648807e34b125a517864c

  • SHA256

    d661e057bc40a5bba10aced246daf2cb328875977cf37c432953a794ac63f839

  • SHA512

    b33b5853ddd4bad39dec50c9485e5ab4766b273c574e18154a1fc65d79f2023c738f9419a546118cfdc21ad12cd2079af58741b368f894454101cf0c60552f05

  • SSDEEP

    1536:o4ZkP+FMr52RqKvJmYFZZJMKo3fm1PYsoFxOZY1nbp7x7fMSKgtAa17LVfJgu:8wMogKvcYFZZjV1n+8Kn17pfMSIsLVp

Score
10/10

Malware Config

Extracted

Family

xworm

C2

activity-fighting.gl.at.ply.gg:38163

Attributes
  • Install_directory

    %AppData%

  • install_file

    XClient.exe

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm family
  • Unsigned PE 2 IoCs

    Checks for missing Authenticode signature.

Files

  • Nursultan_1.16.5.zip
    .zip
  • Nurik 1.16.5 crack/CrackLauncher.exe
    .exe windows:6 windows x64 arch:x64

    6c76e3adbf1f8319a95b2e7a8b38e8b4


    Headers

    Imports

    Sections

  • Nurik 1.16.5 crack/java.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Nurik 1.16.5 crack/start.bat