General

  • Target

    SAM CHEAT bypass.exe

  • Size

    762KB

  • MD5

    5dde6a5017cbb35cf1710069cf9be274

  • SHA1

    a2bb6090abf23364d36210c6fc8ac2c28f8234d2

  • SHA256

    83b5438b0b9aebf778440dcb77eb52b0231133487bdb3b372a91523505ab63c2

  • SHA512

    c7584c7feb4a90feb330a4c0a7e13ca1e785bea150873f30d61f420d6c917e9cd24f69fcb9acf2fe5b8aa1218abb6ea6f0ca1e76d01a8c70bcf95dffe279031b

  • SSDEEP

    12288:5MsLc8V26+8XwREFqAgkRnQWTCoA8JmxfBdEAMjAaDvxCxRc:5MsAT89FDL6oLmhYDjXD4Rc

Score
10/10

Malware Config

Extracted

Family

xworm

C2

147.185.221.23:58112

Attributes
  • Install_directory

    %AppData%

  • install_file

    Realtek HD Audio Universal Service.exe

Extracted

Family

xworm

Version

5.0

C2

147.185.221.20:65300

Mutex

RMe1pa1UgjNcB2Un

Attributes
  • Install_directory

    %AppData%

  • install_file

    Windows Shell Experience Host.exe

aes.plain

Signatures

  • Detect Xworm Payload 2 IoCs
  • Xworm family
  • Unsigned PE 4 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 2 IoCs

Files

  • SAM CHEAT bypass.exe
    .exe windows:4 windows x86 arch:x86

    29b61e5a552b3a9bc00953de1c93be41


    Headers

    Imports

    Sections

  • Realtek HD Audio Universal Service.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • SAM CHEAT bypass.exe
    .exe windows:6 windows x64 arch:x64

    fa42aa5fa812ffc9e36433ab24913f3a


    Headers

    Imports

    Sections

  • Windows Shell Experience Host.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections