Behavioral task
behavioral1
Sample
7чит.exe
Resource
win10v2004-20240802-en
General
-
Target
7чит.exe
-
Size
35KB
-
MD5
c72cf3322b70dadb2eabfcdb7ecd9816
-
SHA1
ebc7fda12492d1c6b81d140b704933040c641be6
-
SHA256
2ba67cb3b309ecc5faf5705af16304b30a835c851aa59b1a05cb969c56e8b35f
-
SHA512
36aa399d640218d3f69c6298cff3ca1ae129748dd0cb2411f61e863417bfa70aaa7ddfc40204c0831afccccc5089f9408a6274b557fd557283629ee2e0fa7a5c
-
SSDEEP
768:AAcLODKXA3+jEwCSjN82KJRAxFk9AI6RO/hzbGK:AVLIzT0wRqFk9AI6RO/JaK
Malware Config
Extracted
xworm
5.0
master-accused.gl.at.ply.gg:53160
tqjmUOGVXtXXs6TJ
-
Install_directory
%AppData%
-
install_file
Runtime Broker.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7чит.exe
Files
-
7чит.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ