Behavioral task
behavioral1
Sample
Delta Crack.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral2
Sample
Delta Crack.exe
Resource
win11-20240802-en
General
-
Target
Delta Crack.rar
-
Size
68KB
-
MD5
2123e3383e3c18812e1151046793631e
-
SHA1
02c534e77c9003ce85816aa52e849d5bcac40e64
-
SHA256
2233318afe5bac24121b8a354e95db48b8c83f44ffa6dc51393551ad02aafc6f
-
SHA512
a38081ab4a79fcca962f1f0949a974cb09c15925260ea8c4d40b20a978389a7e3621121d12595875015bc0e71690b8174dcd663e791a3ba7f98b70b26d628efa
-
SSDEEP
1536:kQm9/qA6wdBM/xf5zAsNnkIgV9e+BiIp6JNxxe0sDajMKpTo:iSzwdB4VmVviIqNDe0sDaI1
Malware Config
Extracted
xworm
127.0.0.1:36929
21.ip.gl.ply.gg:36929
policy-animated.gl.at.ply.gg:36929
123123123qqqqqqq-36929.portmap.host:36929
-
Install_directory
%AppData%
-
install_file
svchost.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule static1/unpack001/Delta Crack.exe family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Delta Crack.exe
Files
-
Delta Crack.rar.rar
Password: 1
-
Delta Crack.exe.exe windows:4 windows x86 arch:x86
Password: 1
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 70KB - Virtual size: 70KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 99KB - Virtual size: 98KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ