Overview

overview

10

Static

static

10

XClie21321...nt.exe

windows7-x64

10

XClie21321...nt.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    XClie213213213213123213nt.exe
  • Size 137KB
  • Sample240401-sq511agh74
  • SHA256 3813890a58d8b0bde2d761c51df42d372fa3c2ca590591c306555d655349a03a
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xwormrattrojan

Malware Config

Extracted

Family

  • xworm

Attributes
  • Install_directory

    %AppData%

  • install_file

    GHGcheat.exe

  • pastebin_url

    https://pastebin.com/raw/VuPEWBmS

Targets

    • Target
      XClie213213213213123213nt.exe
    • Size 137KB
    • SHA256 3813890a58d8b0bde2d761c51df42d372fa3c2ca590591c306555d655349a03a
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xwormrattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks