xworm | MTASA_SPOOFER__SERIAL_CHANGER_V1[.]0[.]rar

Sharing

Copy URL Twitter E-mail

General

Target
MTASA_SPOOFER__SERIAL_CHANGER_V1.0.rar
Size 16KB
Sample250803-lpmppsck6w
SHA256 ddc8492f4d044b6d7fbbbdb3c705b2847503ed47a7bf2665dec46ab6ed508152
MD5 0784128738a4b47cb6a10f99414a1c48
SHA1 783a56aa1d69b0e457709178a8ef576fdcca6e72
SHA512 635d517910c4e5997e9e6e1dd3c5bb9b261568d3d14fc8fbbd12582939408bbeb1b021927610e6ac3f4a63b78e01c725f9514811677551f6139527e76b7b1d9c
SSDEEP 384:CxudtpX1Q0OTZCnFg6XuMqAV/1kVsD8L7enrGERQClrcbH:CxGpFQHQnFgEjD8L7yrGucbH
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xworm

Malware Config

Extracted

Family

xworm

Version

monstr.ddns.net:1177

Mutex

hrrlp3UG4oHVSl9q

Attributes

Install_directory
%AppData%
install_file
RuntimeBroker.exe

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
static1/unpack001/MTASA SPOOFER SERIAL CHANGER V1.0/aZSYX0s1qnq4y7R.exe	family_xworm

Xworm family
xworm

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/MTASA SPOOFER SERIAL CHANGER V1.0/aZSYX0s1qnq4y7R.exe

File Explorer

MTASA_SPOOFER__SERIAL_CHANGER_V1.0.rar

.rar 16KB
MTASA SPOOFER SERIAL CHANGER V1.0/aZSYX0s1qnq4y7R.exe

.exe 34KB

MTASA_SPOOFER__SERIAL_CHANGER_V1.0.rar

SHA256 ddc8492f4d044b6d7fbbbdb3c705b2847503ed47a7bf2665dec46ab6ed508152
MD5 0784128738a4b47cb6a10f99414a1c48
SHA1 783a56aa1d69b0e457709178a8ef576fdcca6e72
SHA512 635d517910c4e5997e9e6e1dd3c5bb9b261568d3d14fc8fbbd12582939408bbeb1b021927610e6ac3f4a63b78e01c725f9514811677551f6139527e76b7b1d9c
SSDEEP 384:CxudtpX1Q0OTZCnFg6XuMqAV/1kVsD8L7enrGERQClrcbH:CxGpFQHQnFgEjD8L7yrGucbH
MD5 SHA1 SHA512 SSDEEP

MTASA SPOOFER SERIAL CHANGER V1.0/aZSYX0s1qnq4y7R.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 4380d2bbe9f643e4cb096c64e63a743d58d655ba4a93993128ff56ed0babe265
MD5 081ee30547b13150c01909b0bd20c106
SHA1 da5427bf5ce71e022a4be45cd1a18dbf3de1957c
SHA512 e05cd290a91f52f737902ca8eac1799ae71e85ba82b89517641eab2a57841f7b9cc587f4f9d3f36bba0293e96d498dc2a2ddd5c5a40a8fc42b4ff802b097913a
SSDEEP 768:CHqIHV3vI2TW/PV8m59FS9YOOjhM/dY7:Ch1QdV8mnFS9YOOjK1Y7
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Detect Xworm Payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

40462

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

MTASA_SPOOFER__SERIAL_CHANGER_V1.0.rar

MTASA SPOOFER SERIAL CHANGER V1.0/aZSYX0s1qnq4y7R.exe

mscoree

dotnet