xworm | XClient[.]exe

General

Target

XClient.exe
Size

32KB
MD5

f9c67a778dd909b400f358c187b45d37
SHA1

862f068560f11c54583bc133cc1fa0af602d4258
SHA256

27d27a73a6311911a6ed166d0552e853323b00857ae29e45c042fb60a9f5f457
SHA512

887a18db9a6a981c0cd088396fc986f96e6e5432fcda76c5ccab7096a760ff8bf54f33cf46aad176ba311725fe00cf54e5e3f9201672b62f022086ca638302be
SSDEEP

768:bvHAVsX0sOoxVJt76NHRVFr9jYOjhWbY:LHNDp97QHDFr9jYOjUU

Score

10^/10

xworm

Malware Config

Extracted

Family

xworm

Version

5.0

C2

remcon.ddns.net:59471

5.tcp.eu.ngrok.io:59471

147.185.221.17:59471

february-wages.gl.at.ply.gg:59471

Mutex

IDov1bfPgP8Y2xdo

Attributes

install_file
USB_Driver.exe

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
sample	family_xworm

Xworm family
xworm

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
XClient.exe

Files

XClient.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

Files

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 30KB - Virtual size: 29KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 12B

.text
Size: 30KB - Virtual size: 29KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B