General
-
Target
Steam.exe
-
Size
144KB
-
MD5
a3614a8b3247b24de5c7ffc763dc1caf
-
SHA1
7e3f222bfb753f1ebf1e27569af7a24d42476b9b
-
SHA256
caf4f464d2b19597c8ea779b41599c211d122e74954cc7c03ee2387f616725d1
-
SHA512
203172dbc4f5d07ac850344dbe0085a61eb18a98dfc5985da19c740490807ebdfaebb1c7b71c78b10c04dc97daafb848333b822f6eab4f94fa4974d2dde42430
-
SSDEEP
3072:PmBMigkWAx9bNTz8KQOiOyuT9F/Zj7Iq+gJTefr:bi7WA/bx5QOuyRnh+g
Malware Config
Extracted
xworm
some-event.gl.at.ply.gg:1337
-
Install_directory
%AppData%
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Steam.exe
Files
-
Steam.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 72KB - Virtual size: 72KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 71KB - Virtual size: 70KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ