Behavioral task
behavioral1
Sample
Crack.exe
Resource
win10-20240404-en
General
-
Target
Crack.exe
-
Size
83KB
-
MD5
fafdca52fa2f2e543c82157ab5bd3abe
-
SHA1
66b2fa2d9b1e58a67723fe98c08352f1668ea561
-
SHA256
fdd41c041dd827148ad8a15c521255c017f1977522a90ef4e94fb898c2a04477
-
SHA512
28869228921b62f13a1975a75f9956909024fd5e59ff1a61152a38feb0cfcb128d76c4a6477b8b8701073e8faa0343612b2cdb94f24fd0ff73f04f98a4a7e561
-
SSDEEP
1536:TOgd9x9J64t5dY63G6IPLh0i6a+bai0bqkTkF6UoBnO0cXSeUd:/9J5uEOh6a+baNOkTkQnOXHy
Malware Config
Extracted
xworm
connection-elect.gl.at.ply.gg:37777
-
Install_directory
%AppData%
-
install_file
Crack.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Crack.exe
Files
-
Crack.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 80KB - Virtual size: 80KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ