Overview

overview

10

Static

static

10

XClient.exe

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    XClient.rar

  • Size

    64KB

  • Sample

    240427-2abxnaab5t

  • MD5

    c648d38f1ea62ccf7d1a541351558f25

  • SHA1

    99ec214b2eb19f67deb8b74763bb24ea3d563ef0

  • SHA256

    c4098d8085097906713a2f1a74d3e2b798d43528dadc1e652e029ffbac7e4b68

  • SHA512

    36cfa56488b4e0773e4dae51d799b8e9f4a70b0857259c613f3fce774ed117550ec0c49a23c52dd1ea965f8f1ad7fc032b4c9bf9cfbf5769d88f431d38168225

  • SSDEEP

    1536:aJLQ99r2ihqbAU/p1OL7ysvcySnlUjLFMgNxp82nNVW:ax+9Ib1sCy2SMa3nG

Score
10/10
xwormrattrojan

Malware Config

Extracted

Family

xworm

Version

3.1

C2

dffsdfsdfe434334.bounceme.net:4500

Mutex

IP78agCbZU6v7ZTL

Attributes
  • install_file

    USB.exe

aes.plain

Targets

    • Target

      XClient.exe

    • Size

      156KB

    • MD5

      206d8c4205aaefb291345d0acd0df1a5

    • SHA1

      a02bad8f9287889809560b99fe46cdc4d73a9fc8

    • SHA256

      37be873cf24a676275343e5f34d7da005a811b8d35a7d6539c06c36d165cd08e

    • SHA512

      a25072486d6f906d07c773847a8f1471f0f2a4aea79a8607ac86b2aa2baac7030c37406d688b42620d8c6d27d9622a2df2721f8764370e6ffcee2a583a0e974a

    • SSDEEP

      3072:N3l4FE9RkOq7RUGKXs+S++7KFSbxeY+qDDrMK:N30E9ZGqStKEbxI

    Score
    10/10
    xwormrattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm
    behavioral1

MITRE ATT&CK Matrix

Tasks