General
-
Target
AyuGram.exe
-
Size
41KB
-
MD5
78e28fd861f6639f530b75078074e29a
-
SHA1
c02da865dc5af2d7d70909f536595cb905b4c0af
-
SHA256
92b5d7c61acf1cb06fc46a23f928551ef1456fefb543bb7d6b928b986fea4251
-
SHA512
276e3a174b0c2aaa7557765f22fd1fd4ace70aa29cbffa79121584ec5c7747921ae500095463ae1975824a504c01543e73bf53182a8cdefa7261080b2efec0d1
-
SSDEEP
768:k8hOzqVhNY8HgbAvrSH7tF5Pa9quuOOwh03/mXO:kerTHCAv6xF49qPOOwi+XO
Malware Config
Extracted
xworm
5.0
needed-below.gl.at.ply.gg:8496
restaurant-volunteer.gl.at.ply.gg:8496
127.0.0.1:8496
147.185.221.26:8496
contains-player.gl.at.ply.gg:8496
SxCIX01GGSj4AMkg
-
Install_directory
%AppData%
-
install_file
rustneats.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource AyuGram.exe
Files
-
AyuGram.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 38KB - Virtual size: 38KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ