General

  • Target

    XClient4.exe

  • Size

    51KB

  • Sample

    240329-alnbaada77

  • MD5

    313762d9258707064b187454b879cc14

  • SHA1

    9e2451ef2a3d2b29e4b051ca6877727fd70535ad

  • SHA256

    042c63ddd8ab56f0b82b1386b9b112a8bb4fe82c896a2274a6e5ac0339f813be

  • SHA512

    82ba224944ae7d7a50f2102594bcd88246194773c71e7aeef2f87c2e43be7f43df22fbc310f4ee07781af471a5d1bdf079ec85a7c6ae7656c978a095db598aea

  • SSDEEP

    1536:vT2oOIzSJ7Ihgj2JmkbgzYTBo0+2aDHOJLH:vTqJ8W3kbgzsTAOJT

Score
10/10

Malware Config

Extracted

Family

xworm

C2

192.168.56.1:5004

Attributes
  • install_file

    USB.exe

Targets

    • Target

      XClient4.exe

    • Size

      51KB

    • MD5

      313762d9258707064b187454b879cc14

    • SHA1

      9e2451ef2a3d2b29e4b051ca6877727fd70535ad

    • SHA256

      042c63ddd8ab56f0b82b1386b9b112a8bb4fe82c896a2274a6e5ac0339f813be

    • SHA512

      82ba224944ae7d7a50f2102594bcd88246194773c71e7aeef2f87c2e43be7f43df22fbc310f4ee07781af471a5d1bdf079ec85a7c6ae7656c978a095db598aea

    • SSDEEP

      1536:vT2oOIzSJ7Ihgj2JmkbgzYTBo0+2aDHOJLH:vTqJ8W3kbgzsTAOJT

    Score
    10/10
    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

MITRE ATT&CK Matrix

Tasks