Behavioral task
behavioral1
Sample
AkrienCracked.exe
Resource
win10-20240611-en
Behavioral task
behavioral2
Sample
AkrienCracked.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
AkrienCracked.exe
Resource
win11-20240802-en
General
-
Target
AkrienCracked.exe
-
Size
58KB
-
MD5
d473edbd7e13a89c9ba7432cfd881bf3
-
SHA1
53cf795d48b7a934b1bb74667ee1c7be3bf49df8
-
SHA256
a470e914cb04f7a2e7d648b0ad467dd2016725717106fa9824636ee031210081
-
SHA512
3405987db5d17e525946b2aac5d64413191295e557cb14b45f08f7888d54a0c7fc1fb50dd97931fc2e6cf52357dc1b7527adc782245dbbc42ebf6cb514ed7cd4
-
SSDEEP
1536:waG+73Z5uwCImqueSVEFsbLE22H6E9OxtkVIeA:wo7nRCPmsbLP2OvStA
Malware Config
Extracted
xworm
-
Install_directory
%LocalAppData%
-
install_file
XClient.exe
-
pastebin_url
https://pastebin.com/raw/TYMFHE5m
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource AkrienCracked.exe
Files
-
AkrienCracked.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 55KB - Virtual size: 55KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ