Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Behavioral task
behavioral1
Sample
кряк/Nursultan.exe
Resource
win7-20241010-en
General
-
Target
bf51886357f6c32afb2b69b79596da66c45f46641dfdee1a0734ce5014850183
-
Size
36KB
-
MD5
c5268051358faabffe383ffd18683e26
-
SHA1
72c13d535fdad51fcf8755703a6f7b63e75a9fa9
-
SHA256
bf51886357f6c32afb2b69b79596da66c45f46641dfdee1a0734ce5014850183
-
SHA512
815708df618a05317204e082cd18158721225d356aa9ed503f291223a3e8a5687f96dbe7264fbc15d3bb11aa441b437e29e7574e7170a1fb4aa15a878a561a72
-
SSDEEP
768:R85WyLSeTgwy8x7/MhTK/ZxTyZevRXH7Y4QIc:R85WKUwxjxTVRXbbfc
Malware Config
Extracted
xworm
5.0
127.0.0.1:8067
uevfZl7Tf1ThWFdr
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule static1/unpack001/кряк/Nursultan.exe family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/кряк/Nursultan.exe
Files
-
bf51886357f6c32afb2b69b79596da66c45f46641dfdee1a0734ce5014850183.zip
-
кряк/Nursultan.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 30KB - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 109KB - Virtual size: 108KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ