Behavioral task
behavioral1
Sample
FortniteCheat.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
FortniteCheat.exe
Resource
win10v2004-20240802-en
General
-
Target
FortniteCheat.exe
-
Size
45KB
-
MD5
911fe21c2b8ecf36fd551ba48a2261b1
-
SHA1
5a8eda4aef6924b111a4e90ceab86c61f6f11d34
-
SHA256
0b8689cf0093d5f1a0be894bac61050884db288676e4362716a6e215ac827468
-
SHA512
01cdeccc00cbb16b444300198985e1a6237d73efb9ce211bf1c52e5608fde40f6b0aa485d1b2e9252e3f955a3d9c18237184c9734fab08b76baf0fe1308389df
-
SSDEEP
768:2S4yVO+lq6Vnn9ej4cb1UrW4t82vJ6lEbFEPG9pHGu6vOChHzYi34e:2S4Gjlq6TecA1UKhEF19VGu6vOCV5oe
Malware Config
Extracted
xworm
5.0
147.185.221.22:11860
8YzGx35Q5ExHCG7f
-
Install_directory
%LocalAppData%
-
install_file
Windows Host Proccess.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource FortniteCheat.exe
Files
-
FortniteCheat.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 43KB - Virtual size: 42KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ