Behavioral task
behavioral1
Sample
cheat auto.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
cheat auto.exe
Resource
win10v2004-20240709-en
General
-
Target
cheat auto.exe
-
Size
65KB
-
MD5
4c89044bd8305a2b0913086d24b204fa
-
SHA1
eb0995df80b91adbec7b4d8ed1f6fcd94275c833
-
SHA256
c8d129ce62ef51f69f09943d6f24a67ccddfc2cfd39adaf552040da3188d7af6
-
SHA512
c0cebd214f449bfebbb9acd374b697384e55916daafe2b4e47d2c5cd5770a4b930de230714af2a47a8bc5713100223a61209b3cfecefde99d912fecb68124b47
-
SSDEEP
1536:N8kCehg/F6nxsR+ntxabxLMmz5ocpNk6lo5OMOTsn:c2g/qsR+ntxabxLT5oc36OMOTsn
Malware Config
Extracted
xworm
stores-achieved.gl.at.ply.gg:64510
-
Install_directory
%AppData%
-
install_file
XClient.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cheat auto.exe
Files
-
cheat auto.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 63KB - Virtual size: 62KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ