General

  • Target

    Nurik 1.12.2-1.16.5.rar

  • Size

    9.7MB

  • MD5

    9c24f5afafb5485602bb389ac6b92867

  • SHA1

    d129eec0347c9ed7136508fa9c53d52d7be32fe4

  • SHA256

    a02f4d66be93cac92899b5c049d2eb5758bcd928908123e344806b7568faeded

  • SHA512

    87af3614369e0258e500596ff872a09395085bae4de1d34a3ad134f98ae563e29fb435e375d25eaa046df22fe740154e19b3084bd57473b36c80ab7d20ca5af3

  • SSDEEP

    196608:zufLYMePTVw+Qo3dnhQAiJBcH7Y3r7ufvnQwAWRjt0P7s9vMu70klu/o:zuTr6p1hQD3cH23SnQwFRjtiWvMfro

Score
10/10

Malware Config

Extracted

Family

xworm

Version

5.0

C2

Idlerkik-51025.portmap.host:51025

Mutex

rSFFOfqaVoKkdUae

Attributes
  • Install_directory

    %AppData%

  • install_file

    svhost.exe

aes.plain

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm family
  • Unsigned PE 12 IoCs

    Checks for missing Authenticode signature.

Files

  • Nurik 1.12.2-1.16.5.rar
    .rar

    Password: 123

  • Nursultan 1.12.2-1.16.5 Crack/CrackLauncher.exe
    .exe windows:4 windows x86 arch:x86

    Password: 123

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Nursultan 1.12.2-1.16.5 Crack/README.txt
  • Nursultan 1.12.2-1.16.5 Crack/cfg/35215.cfg
  • Nursultan 1.12.2-1.16.5 Crack/cfg/GREEN.cfg.cfg
  • Nursultan 1.12.2-1.16.5 Crack/cfg/GREEN.cfg2.cfg
  • Nursultan 1.12.2-1.16.5 Crack/cfg/GREEN.cfg3.cfg
  • Nursultan 1.12.2-1.16.5 Crack/cfg/Semi-Rage Comfort (By DW1337).cfg
  • Nursultan 1.12.2-1.16.5 Crack/cfg/best_primecfg.cfg
  • Nursultan 1.12.2-1.16.5 Crack/client/darkedge.vmt
  • Nursultan 1.12.2-1.16.5 Crack/client/darkedge.vtf
  • Nursultan 1.12.2-1.16.5 Crack/client/hit01.vtf
  • Nursultan 1.12.2-1.16.5 Crack/client/hit02.vtf
  • Nursultan 1.12.2-1.16.5 Crack/client/nvidiaapp.dll
  • Nursultan 1.12.2-1.16.5 Crack/files/$1b.vmt
  • Nursultan 1.12.2-1.16.5 Crack/files/$1b.vtf
  • Nursultan 1.12.2-1.16.5 Crack/files/$20@003_b1.vmt
  • Nursultan 1.12.2-1.16.5 Crack/files/$20@003_b1.vtf
  • Nursultan 1.12.2-1.16.5 Crack/files/$20@004_b2.vmt
  • Nursultan 1.12.2-1.16.5 Crack/files/$20@004_b2.vtf
  • Nursultan 1.12.2-1.16.5 Crack/files/animatedeyes/animated_eyes.vmt
  • Nursultan 1.12.2-1.16.5 Crack/files/animatedeyes/animated_eyes.vtf
  • Nursultan 1.12.2-1.16.5 Crack/files/fluttercore.vmt
  • Nursultan 1.12.2-1.16.5 Crack/files/fluttercore.vtf
  • Nursultan 1.12.2-1.16.5 Crack/files/largesmoke.vmt
  • Nursultan 1.12.2-1.16.5 Crack/files/largesmoke.vtf
  • Nursultan 1.12.2-1.16.5 Crack/files/outline_translucent.vtf
  • Nursultan 1.12.2-1.16.5 Crack/files/softglow_translucent_fog.vmt
  • Nursultan 1.12.2-1.16.5 Crack/java/ForgeOptiFine 1.12.2.jar
    .jar
  • Nursultan 1.12.2-1.16.5 Crack/java/ForgeOptiFine 1.12.2.json
  • Nursultan 1.12.2-1.16.5 Crack/java/TLauncherAdditional.json
  • Nursultan 1.12.2-1.16.5 Crack/java/natives/OpenAL32.dll
    .dll windows:5 windows x86 arch:x86

    Password: 123

    82d20d7e5aa7e0fb272540012328f63c


    Headers

    Imports

    Exports

    Sections

  • Nursultan 1.12.2-1.16.5 Crack/java/natives/OpenAL64.dll
    .dll windows:5 windows x64 arch:x64

    Password: 123

    633c2f0413d82c85233cd12dfd3f70d6


    Headers

    Imports

    Exports

    Sections

  • Nursultan 1.12.2-1.16.5 Crack/java/natives/SAPIWrapper_x64.dll
    .dll windows:6 windows x64 arch:x64

    Password: 123

    6159d78f91fdaebe8b20aac0d9eaf0d0


    Headers

    Imports

    Exports

    Sections

  • Nursultan 1.12.2-1.16.5 Crack/java/natives/SAPIWrapper_x86.dll
    .dll windows:6 windows x86 arch:x86

    Password: 123

    e421b06fc313af45bea4c86a6229f20d


    Headers

    Imports

    Exports

    Sections

  • Nursultan 1.12.2-1.16.5 Crack/java/natives/jinput-dx8.dll
    .dll windows:5 windows x86 arch:x86

    Password: 123

    8aec3cd2fb727c45df4ffd891336ebb6


    Headers

    Imports

    Exports

    Sections

  • Nursultan 1.12.2-1.16.5 Crack/java/natives/jinput-dx8_64.dll
    .dll windows:5 windows x64 arch:x64

    Password: 123

    775f39aab202a1f05940d27f0b92a7bd


    Headers

    Imports

    Exports

    Sections

  • Nursultan 1.12.2-1.16.5 Crack/java/natives/jinput-raw.dll
    .dll windows:5 windows x86 arch:x86

    Password: 123

    59077abdf502a0058489863f48dd1d26


    Headers

    Imports

    Exports

    Sections

  • Nursultan 1.12.2-1.16.5 Crack/java/natives/jinput-raw_64.dll
    .dll windows:5 windows x64 arch:x64

    7197ad91906d99533954489f893101f1


    Headers

    Imports

    Exports

    Sections

  • Nursultan 1.12.2-1.16.5 Crack/java/natives/jinput-wintab.dll
    .dll windows:5 windows x86 arch:x86

    43b2507faccc65369244b2bf3d687cad


    Headers

    Imports

    Exports

    Sections

  • Nursultan 1.12.2-1.16.5 Crack/java/natives/lwjgl.dll
    .dll windows:5 windows x86 arch:x86

    7edf294504a49a32026d7f01e24e6450


    Headers

    Imports

    Exports

    Sections

  • Nursultan 1.12.2-1.16.5 Crack/java/natives/lwjgl64.dll
    .dll windows:5 windows x64 arch:x64

    c82a02ad3db1bbcc897369a48967cd74


    Headers

    Imports

    Exports

    Sections

  • Nursultan 1.12.2-1.16.5 Crack/loader/client.cfg
  • Nursultan 1.12.2-1.16.5 Crack/loader/favorites.cfg
  • Nursultan 1.12.2-1.16.5 Crack/loader/keys.cfg
  • Nursultan 1.12.2-1.16.5 Crack/loader/steam_autocloud.vdf