General
-
Target
Aimwar.exe
-
Size
60KB
-
MD5
ed7bbef10fa65a3a6b86c16e3a6ef78d
-
SHA1
69437137f213ce15f7510b79c28b7e9bd7bcd9e0
-
SHA256
32fd8036bd5a0d9cbf95c33bc77c84ce5a75143485d39693f6b2046ef6b5cb3c
-
SHA512
7583fa5c4762b7d8b7cd583bae5b87f768628ec86a8ecdeff9f2837618d89fbe2364ce2093c543dedd00d3fe33e31e5e3167a92071e3ee5026cfcc444576bea3
-
SSDEEP
1536:Y/HuxuLApViTDbHjoGjkb/lDPQa4wXUCKOwAmPS:qHuM0pITnjNjkb/lBQCKOwAmPS
Malware Config
Extracted
xworm
hospital-point.gl.at.ply.gg:32441
-
Install_directory
%ProgramData%
-
install_file
Steam.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Aimwar.exe
Files
-
Aimwar.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 57KB - Virtual size: 57KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ