Behavioral task
behavioral1
Sample
AllCheats.exe
Resource
win11-20240802-en
General
-
Target
AllCheats.exe
-
Size
62KB
-
MD5
0cea8d1794672ec6ee2b9566a69be6f7
-
SHA1
e67244ae8e6b513b21073ea5d25c214faa087fc2
-
SHA256
bc3b39ca07ccb1e0d7b71c103b759fce819d1aa492321b19c7b39023c1fa1b19
-
SHA512
5f35f979e08142787071991ec3dcbd1c9990b6538928c44f224bb98c5ee490b6502d296207a62950028f8c535fb571aa279eeca1b187ab4a874748498992849b
-
SSDEEP
768:MKOhtw7MAV2ycMmnu9y6Dsr1Er+ba6fLX89DfovNbrE6POm8hk9dM/j:MB3+xmajDsRlba6TMqhE6POm8sdWj
Malware Config
Extracted
xworm
127.0.0.1:48534
localhost:48534
domain-vote.gl.at.ply.gg:48534
-
Install_directory
%AppData%
-
install_file
XClient.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource AllCheats.exe
Files
-
AllCheats.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 59KB - Virtual size: 59KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ