General

  • Target

    XClient_3.bin

  • Size

    36KB

  • Sample

    230830-hsxgjaac92

  • MD5

    a4b63c56b018a0df0864ac93518e23f2

  • SHA1

    aac28ab89ed8e522b3c98edd086e264a844cb1f3

  • SHA256

    2eb02ce78ef2d03967bd2bd9bfca795a49c769120a65515234318bafe2106e50

  • SHA512

    045e25c30bf9fd25c04bef21cd08374f8c5a6101bbe0988998e0d368aa90e4af14b5579a5219f9eeedc72303d55150fce86cd13b394ebb28d1faadfd768e21d3

  • SSDEEP

    768:iJTGHc+WWls9fMO20ImlVFp/X/FP79lDO9hDApi:i5Yc40bI6TnFz9lDO9R

Score
10/10

Malware Config

Extracted

Family

xworm

C2

16.ip.gl.ply.gg:15179

Mutex

wPJHugnoj2JkmLtM

Attributes
  • install_file

    svchost.exe

aes.plain

Targets

    • Target

      XClient_3.bin

    • Size

      36KB

    • MD5

      a4b63c56b018a0df0864ac93518e23f2

    • SHA1

      aac28ab89ed8e522b3c98edd086e264a844cb1f3

    • SHA256

      2eb02ce78ef2d03967bd2bd9bfca795a49c769120a65515234318bafe2106e50

    • SHA512

      045e25c30bf9fd25c04bef21cd08374f8c5a6101bbe0988998e0d368aa90e4af14b5579a5219f9eeedc72303d55150fce86cd13b394ebb28d1faadfd768e21d3

    • SSDEEP

      768:iJTGHc+WWls9fMO20ImlVFp/X/FP79lDO9hDApi:i5Yc40bI6TnFz9lDO9R

    Score
    10/10
    • Xworm

      Xworm is a remote access trojan written in C#.

    • Drops startup file

MITRE ATT&CK Enterprise v15

Tasks