Behavioral task
behavioral1
Sample
bkcracker-privateV1.2.exe
Resource
win7-20240903-en
General
-
Target
bkcracker-privateV1.2.exe
-
Size
79KB
-
MD5
47abba11eb5de0176dc2620268f973b9
-
SHA1
88c65fd19f6f158164e7052285cb08a3bc3b1577
-
SHA256
e9757cf90a5b034412b7f5cdd7211b3274d22f981fa0cace2a4a67e0e9ad0be8
-
SHA512
cd9772dfa31d7b4fa81bc32d6c18db84f50bad47a80b0ba1f9d328ee532e0a3b72a4fbbd1d3739e469d4566bcf32fe5188a1f7969076b883b46f74416a7869e7
-
SSDEEP
1536:uq9exgGaR2sY5RYM/+YfYFb9qosm3zqjL/Rcop8OczVrl6n2L9v0gjRh:uqnfvEGmUFb9guoiOexl3MMh
Malware Config
Extracted
xworm
10.0.0.97:7000
-
Install_directory
%AppData%
-
install_file
XClient.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bkcracker-privateV1.2.exe
Files
-
bkcracker-privateV1.2.exe.exe windows:4 windows x86 arch:x86
Password: 1
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 76KB - Virtual size: 76KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ