Overview
overview
10Static
static
10Nursultan ...er.exe
windows7-x64
10Nursultan ...er.exe
windows10-2004-x64
10Nursultan ...pp.dll
windows7-x64
1Nursultan ...pp.dll
windows10-2004-x64
1Nursultan ....2.jar
windows7-x64
1Nursultan ....2.jar
windows10-2004-x64
1Nursultan ...32.dll
windows7-x64
3Nursultan ...32.dll
windows10-2004-x64
3Nursultan ...64.dll
windows7-x64
1Nursultan ...64.dll
windows10-2004-x64
1Nursultan ...64.dll
windows7-x64
3Nursultan ...64.dll
windows10-2004-x64
1Nursultan ...86.dll
windows7-x64
3Nursultan ...86.dll
windows10-2004-x64
3Nursultan ...x8.dll
windows7-x64
3Nursultan ...x8.dll
windows10-2004-x64
3Nursultan ...64.dll
windows7-x64
1Nursultan ...64.dll
windows10-2004-x64
1Nursultan ...aw.dll
windows7-x64
3Nursultan ...aw.dll
windows10-2004-x64
3Nursultan ...64.dll
windows7-x64
1Nursultan ...64.dll
windows10-2004-x64
1Nursultan ...ab.dll
windows7-x64
3Nursultan ...ab.dll
windows10-2004-x64
3Nursultan ...gl.dll
windows7-x64
3Nursultan ...gl.dll
windows10-2004-x64
3Nursultan ...64.dll
windows7-x64
1Nursultan ...64.dll
windows10-2004-x64
1General
-
Target
Nurik 1.12.2-1.16.5.rar
-
Size
9.7MB
-
Sample
250306-r42eas1qt8
-
MD5
9c24f5afafb5485602bb389ac6b92867
-
SHA1
d129eec0347c9ed7136508fa9c53d52d7be32fe4
-
SHA256
a02f4d66be93cac92899b5c049d2eb5758bcd928908123e344806b7568faeded
-
SHA512
87af3614369e0258e500596ff872a09395085bae4de1d34a3ad134f98ae563e29fb435e375d25eaa046df22fe740154e19b3084bd57473b36c80ab7d20ca5af3
-
SSDEEP
196608:zufLYMePTVw+Qo3dnhQAiJBcH7Y3r7ufvnQwAWRjt0P7s9vMu70klu/o:zuTr6p1hQD3cH23SnQwFRjtiWvMfro
Behavioral task
behavioral1
Sample
Nursultan 1.12.2-1.16.5 Crack/CrackLauncher.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
Nursultan 1.12.2-1.16.5 Crack/CrackLauncher.exe
Resource
win10v2004-20250217-en
Behavioral task
behavioral3
Sample
Nursultan 1.12.2-1.16.5 Crack/client/nvidiaapp.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
Nursultan 1.12.2-1.16.5 Crack/client/nvidiaapp.dll
Resource
win10v2004-20250217-en
Behavioral task
behavioral5
Sample
Nursultan 1.12.2-1.16.5 Crack/java/ForgeOptiFine 1.12.2.jar
Resource
win7-20241010-en
Behavioral task
behavioral6
Sample
Nursultan 1.12.2-1.16.5 Crack/java/ForgeOptiFine 1.12.2.jar
Resource
win10v2004-20250217-en
Behavioral task
behavioral7
Sample
Nursultan 1.12.2-1.16.5 Crack/java/natives/OpenAL32.dll
Resource
win7-20241010-en
Behavioral task
behavioral8
Sample
Nursultan 1.12.2-1.16.5 Crack/java/natives/OpenAL32.dll
Resource
win10v2004-20250217-en
Behavioral task
behavioral9
Sample
Nursultan 1.12.2-1.16.5 Crack/java/natives/OpenAL64.dll
Resource
win7-20241010-en
Behavioral task
behavioral10
Sample
Nursultan 1.12.2-1.16.5 Crack/java/natives/OpenAL64.dll
Resource
win10v2004-20250217-en
Behavioral task
behavioral11
Sample
Nursultan 1.12.2-1.16.5 Crack/java/natives/SAPIWrapper_x64.dll
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
Nursultan 1.12.2-1.16.5 Crack/java/natives/SAPIWrapper_x64.dll
Resource
win10v2004-20250217-en
Behavioral task
behavioral13
Sample
Nursultan 1.12.2-1.16.5 Crack/java/natives/SAPIWrapper_x86.dll
Resource
win7-20241023-en
Behavioral task
behavioral14
Sample
Nursultan 1.12.2-1.16.5 Crack/java/natives/SAPIWrapper_x86.dll
Resource
win10v2004-20250217-en
Behavioral task
behavioral15
Sample
Nursultan 1.12.2-1.16.5 Crack/java/natives/jinput-dx8.dll
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
Nursultan 1.12.2-1.16.5 Crack/java/natives/jinput-dx8.dll
Resource
win10v2004-20250217-en
Behavioral task
behavioral17
Sample
Nursultan 1.12.2-1.16.5 Crack/java/natives/jinput-dx8_64.dll
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
Nursultan 1.12.2-1.16.5 Crack/java/natives/jinput-dx8_64.dll
Resource
win10v2004-20250217-en
Behavioral task
behavioral19
Sample
Nursultan 1.12.2-1.16.5 Crack/java/natives/jinput-raw.dll
Resource
win7-20241010-en
Behavioral task
behavioral20
Sample
Nursultan 1.12.2-1.16.5 Crack/java/natives/jinput-raw.dll
Resource
win10v2004-20250217-en
Behavioral task
behavioral21
Sample
Nursultan 1.12.2-1.16.5 Crack/java/natives/jinput-raw_64.dll
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
Nursultan 1.12.2-1.16.5 Crack/java/natives/jinput-raw_64.dll
Resource
win10v2004-20250217-en
Behavioral task
behavioral23
Sample
Nursultan 1.12.2-1.16.5 Crack/java/natives/jinput-wintab.dll
Resource
win7-20241023-en
Behavioral task
behavioral24
Sample
Nursultan 1.12.2-1.16.5 Crack/java/natives/jinput-wintab.dll
Resource
win10v2004-20250217-en
Behavioral task
behavioral25
Sample
Nursultan 1.12.2-1.16.5 Crack/java/natives/lwjgl.dll
Resource
win7-20250207-en
Behavioral task
behavioral26
Sample
Nursultan 1.12.2-1.16.5 Crack/java/natives/lwjgl.dll
Resource
win10v2004-20250217-en
Behavioral task
behavioral27
Sample
Nursultan 1.12.2-1.16.5 Crack/java/natives/lwjgl64.dll
Resource
win7-20241010-en
Behavioral task
behavioral28
Sample
Nursultan 1.12.2-1.16.5 Crack/java/natives/lwjgl64.dll
Resource
win10v2004-20250217-en
Malware Config
Extracted
xworm
5.0
Idlerkik-51025.portmap.host:51025
rSFFOfqaVoKkdUae
-
Install_directory
%AppData%
-
install_file
svhost.exe
Targets
-
-
Target
Nursultan 1.12.2-1.16.5 Crack/CrackLauncher.exe
-
Size
42KB
-
MD5
4f7d0cb075b81a3923661409b47e8a31
-
SHA1
d3aa635fedd9adff2a821fa20e7f8b9fac838ed4
-
SHA256
4e3b031bcd6552a48501e629c37e53d58721cde1b494ee96f8ba9473be7ff6d6
-
SHA512
3e3fea0be7af651bb2b7eba42543112912808931a9f8f84e7ab8f424910b190c113a99bf4859d032bc0ae3478398b93ffe5d025b7dc1dffe37111ea6d3e7a66e
-
SSDEEP
768:oTafJRPSlKSmUO2DXFyp9ORLM56YOjhWPyVGO:oTKJqm2TF09MLg6YOj0JO
-
Detect Xworm Payload
-
Xworm family
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
-
-
Target
Nursultan 1.12.2-1.16.5 Crack/client/nvidiaapp.dll
-
Size
9KB
-
MD5
f561294fd2c3b4553f247b5a22e180ed
-
SHA1
4ee925f9d6a21f06555ef1d873f68347c24183ae
-
SHA256
cf3608a24fb8b424047db7b3b7bba7b45455cadc21aa0d9ae9da6c51c26ad417
-
SHA512
beb5b4dde5efa47753c10997b391a4fa9a2bc12a7e64831603c1c4f047a9008e671ca9a4f7a22fff2f5317e17126f765ed71344ccc72f41c5b7d8123e47013dd
-
SSDEEP
192:Cos0s0s0s0s0s0s0s0s0s0s0s0s0s0s0s0s0s0m:Cos0s0s0s0s0s0s0s0s0s0s0s0s0s0sj
Score1/10 -
-
-
Target
Nursultan 1.12.2-1.16.5 Crack/java/ForgeOptiFine 1.12.2.jar
-
Size
9.7MB
-
MD5
8c0443868b9e46c77d39db61c755679d
-
SHA1
0f275bc1547d01fa5f56ba34bdc87d981ee12daf
-
SHA256
8ada07da5ee77dad3527bd7278fbd05ee1fc8a597813b216a871a2d7d64cc64f
-
SHA512
3afe108c273a6bbe17f2f88da49e5a21a5dfd0250c03ae51d7c70493d6ca015d75abc867378f7f30d62ac9535a8a5f06c62880dda8b31c68d734a1a8623347fe
-
SSDEEP
196608:pqLAzKzjjIsrrpME754ze1Be6etSSN5edf64UFOTYVGQA1c+:QAzKn1rdMEdlBe6+3edfxUA1zz
Score1/10 -
-
-
Target
Nursultan 1.12.2-1.16.5 Crack/java/natives/OpenAL32.dll
-
Size
381KB
-
MD5
9e02334f9bba622885eadb059f0633b3
-
SHA1
ede381bf55e7d0cd3a7e058237bbc66a8ff63837
-
SHA256
baf27fc91dc852d78889e052cfc9ed2b6fc0927258bb507a895c6fcd50f10fef
-
SHA512
066eaaee241976d99e3f11de415976fb0e47e97035d4d7a7c121c33882190f3546637650f841a2858ac1734655f4994dc2cb8c5bdda5828557485fc20a779def
-
SSDEEP
6144:qB0wNMEdGJE5cN8PLJ8I1kabGLPwrWr+JervPI6YXaZ8AO8+H1MOi7BU:qBDL+af1kabGL/r+JwvPjKaZ8NMO
Score3/10 -
-
-
Target
Nursultan 1.12.2-1.16.5 Crack/java/natives/OpenAL64.dll
-
Size
373KB
-
MD5
89021c218a3f6feb807a664f852ffbd3
-
SHA1
97362fba53dfb6d9581b8c64829f4b1d98a97855
-
SHA256
9261b66010a845ddef9f61d5e4266fe2f08a53f3605da002e9e8f8d202bdbc5e
-
SHA512
e511c707c4453016cdeefcbc863fbf2750ad9cda12ad31f27369d5a396f9c98d9ef37fafb4030c683f17b1e2cdcfce924015fe49dd6652c3060bb0ba77ea3064
-
SSDEEP
6144:ABdTusYmeqPD3H/Jm9iQV4+ttOpJ2z4dpFg1RB/vPI6YXaZqRs0:AjTWIbgOmyEvPjKaZqR
Score1/10 -
-
-
Target
Nursultan 1.12.2-1.16.5 Crack/java/natives/SAPIWrapper_x64.dll
-
Size
83KB
-
MD5
2675265c0f5baa7483a6b66b7ddd1226
-
SHA1
7fdbc1a8a9c0e550e95b7444369529c823f7d24f
-
SHA256
241dd8e036a1cd27dfd7bc52027aa5c02528ce5138c5515c4864db723b109731
-
SHA512
baf8123edf643cce5eec7457dab131d0906971ff5f8de039bfbb4a5ef22da35a770dfc8809f8731d6fd17c5efcce4cb7605d59a4e4e6688aa417988386463e52
-
SSDEEP
1536:i0pQvAZX4pQe0KmVmk/H/SRAqg1wsWjGpRsBQ+8/iJyzfGdc9dlUmcc7BI:i0pRXe1mVhH/SRhI0GpRsBQ+8/iJyzfk
Score3/10 -
-
-
Target
Nursultan 1.12.2-1.16.5 Crack/java/natives/SAPIWrapper_x86.dll
-
Size
69KB
-
MD5
41dfbc2efe788a9aa10317c1a1a19f63
-
SHA1
d48b1c8b9e20f9e4de21497d6dda1fba2f0d84d1
-
SHA256
58488c47b41bed97913e5694a6bbe418dffb4055cb2bda28348b6381a86f98c7
-
SHA512
d9fcd723d8fcbb72de571c6196b3771d88c8d12fe843cc6196eb1f733b322d211be419aebf7133c7d1d339205e2a548e306b6c910745688aefcfc0c8a60d23cf
-
SSDEEP
1536:QnhkNXcIOIIWXikjzY2Eeq8+Q4fsWZQcdyyyhc2h8xFYD:FIWSkzYTlVJyRh+xF2
Score3/10 -
-
-
Target
Nursultan 1.12.2-1.16.5 Crack/java/natives/jinput-dx8.dll
-
Size
60KB
-
MD5
ec587acff9c06d699829908b515ea17e
-
SHA1
50348b2958b017df3bf30d7915ab61a4cb9a2b33
-
SHA256
89779abf806a93dd809bc7a4914967d0e6924dedf293afd48dd205dbce87d8b8
-
SHA512
2a7895d6196e3f1f740982bd4d0daeba255a033c971638e3aebd2cd2233c39f7c8e92c72d2eeb41f8b368d388a3b270fee2cbe219ee239f5d62af9f6f8ed72d7
-
SSDEEP
768:2Rj4ZLedvA5Z3cYlqcMOml0V6jY/MDS5TQkuzFqIn1pCDFECBXT7kE:gyLwvA/cYuLpYMSp2zJn330TT
Score3/10 -
-
-
Target
Nursultan 1.12.2-1.16.5 Crack/java/natives/jinput-dx8_64.dll
-
Size
63KB
-
MD5
90cab52fca89e7d233741c0439dc2005
-
SHA1
5d9a7d3fb6224dab97aaff7bd9430232732d9be8
-
SHA256
a38cb458b9e5a246d7418f38ac04430c2e5a3f46b082955d6dfd5d2bd74f4222
-
SHA512
041ca3aa3d6560f207d841c8af1939e4e93538fe4f34d74fb9eee003733d98783914c6cbe45022c483a6cfb54f0e4f25013f67851d9ae6e9ea6a8cc158d28936
-
SSDEEP
1536:PVt32LOgsg0Vn88QhCuUDhsI0CSS2u4mL5Ie2JQ:H2JsLV88QguUFT9DL5I9JQ
Score1/10 -
-
-
Target
Nursultan 1.12.2-1.16.5 Crack/java/natives/jinput-raw.dll
-
Size
58KB
-
MD5
0862d141de8b4dd93ac55cd4a1a78b69
-
SHA1
4d982f408e815519c2289cd720c78338392a9887
-
SHA256
0a8c0b47e173453bd92da224f73a6aff35b07c2db315abaf33e68edbdb147971
-
SHA512
c070516f902082c3eda3f19fab6d6a6998442664f1b25d5d4c2229c03b7cac1a2a41d78b98474dfde3514bc206f5fb92e1949627e3e64052e0ed880e3f6a52ad
-
SSDEEP
768:YxAM8x3LQmQhccHXx+LHfFCxMJvI/+q9c6LTZsTUkwS9/FE5HBXTWoJCRX:tDI3+jFWTLTiUknG5NT9JMX
Score3/10 -
-
-
Target
Nursultan 1.12.2-1.16.5 Crack/java/natives/jinput-raw_64.dll
-
Size
61KB
-
MD5
ffc85e4a631d90112aee8e213cd367cd
-
SHA1
067c11135f9ebeb554d5f80b7a8a5244c0f3b7d7
-
SHA256
832308f96b1760f2ebc183d1a1771278bb3236e4567dd7a23e1eaecf95f9c03c
-
SHA512
376393d9351ad2317bdff831df012ef993039c6bcb0616dec3c91ff1b13568a6f04c3bc8a0f9888aabafa7182513fe5f7fe5fe1fca7f14f64b58414e02bd8c48
-
SSDEEP
1536:ZFG7/fQHJY7EJsvjf30G8DbI7RfnBUVEGhM0q2JKmf6:ZFG7QHy7EJsvjfkG8QnByfJKm
Score1/10 -
-
-
Target
Nursultan 1.12.2-1.16.5 Crack/java/natives/jinput-wintab.dll
-
Size
55KB
-
MD5
7b5d669b490d5737d8a9d1f96274e2e5
-
SHA1
e7b9beead279298611d0c4753089d3af07c4c9e9
-
SHA256
59201c94eb563025e47fe6b6f5c4dc326f0059d49285e2d3a44482cb60ffc9e2
-
SHA512
ac43cfe9e3ef9dc0e1d2e49a8bbba041b5eca0d4822e694031c694f463017f39ad0131b9f689cc30d177bbf0253f6d2942314683c1ab51a54674ad1309baaeff
-
SSDEEP
768:gxucOm6iQLZXNvJGgY1mus+XBpkJ3L6GAwk44Rv+1mYxTauAR:ZcZQbzZC8J3LfA0Wk1T4R
Score3/10 -
-
-
Target
Nursultan 1.12.2-1.16.5 Crack/java/natives/lwjgl.dll
-
Size
299KB
-
MD5
2644c73a80eb9f9fb7f81a2a5e546642
-
SHA1
6f1661fc6952312a9f34dfa6d3840b46e9c85e63
-
SHA256
fff711369747e9bb3656d4c5bdee7051bbc13f30abd634418bf40706a25f365c
-
SHA512
b67cb978b780fff10df8e610b722b81f7b68168bf4510cfd9406c65182703d8f42fc88820861e73f78ba75cb70d2f29c6b0978d7a02b0d196699c2650d869ae6
-
SSDEEP
3072:zd8I6dvi/byiLxRfg6p2ykoDYABr2JFcLN9Z5S0QoY6Pw5W+LMm002eunkmKq/XD:zqrd+DT2gLN9HKlmKqz
Score3/10 -
-
-
Target
Nursultan 1.12.2-1.16.5 Crack/java/natives/lwjgl64.dll
-
Size
310KB
-
MD5
0b9fcfbd6d44e4d83605cc35171668c8
-
SHA1
f4013116d6750829851370ed19a9eaf8251ad6e1
-
SHA256
ebdcedbc3e24b911aacd7bb666ab426397ca7d7883a8d4e3cf28946041c95425
-
SHA512
e920e284f47f888d10cac45ec8775e58481f5a8c2316d3fa01ff1e7b1bb63c64d2d0850b2da8fd040727b969d3b3f9b85afbd86b6cbfaecca580b853a1499f59
-
SSDEEP
3072:Jy6nSomUPQukwpSor62AIiGYIR2LGPHc0Ul+S4KQdw6tqYKVFlCh7NZqSEgbh:JciFkwpL2DI0yPHTw6tVKYr
Score1/10 -