Overview

overview

10

Static

static

10

XClient.exe

windows7-x64

10

XClient.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    XClient.exe

  • Size

    33KB

  • Sample

    240409-144zvsea95

  • MD5

    6a0dd7035dd8b214bc0e89abac86965b

  • SHA1

    bc37b9bd002d6e10e7922992d6c5cdd636f9820e

  • SHA256

    10893249600c494365edddc0bcca1b6bf5012f777cb375cd529972a0f94e9fa7

  • SHA512

    713a8515ed9f1ab509317593ac7b0b793af62b78a8d744bc532332d07f735b017e260872a1d0b77af14a1f753bd15c121d52a6a09f293f0e322f6313aec28216

  • SSDEEP

    768:3dKk9oVQUzoxVJt76NHRVFr9jcaIOjhBbS:NKD/y97QHDFr9jOOjve

Score
10/10
xwormrattrojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

127.0.0.1:23638

209.25.140.1:5525:23638

bring-recorder.gl.at.ply.gg:23638

action-yesterday.gl.at.ply.gg:23638

147.185.221.19:23638

then-wheel.gl.at.ply.gg::23638

then-wheel.gl.at.ply.gg:23638

teen-modes.gl.at.ply.gg:23638
Mutex

LbSpssCFgm7ibxmv

Attributes
  • install_file

    USB.exe

aes.plain

Targets

    • Target

      XClient.exe

    • Size

      33KB

    • MD5

      6a0dd7035dd8b214bc0e89abac86965b

    • SHA1

      bc37b9bd002d6e10e7922992d6c5cdd636f9820e

    • SHA256

      10893249600c494365edddc0bcca1b6bf5012f777cb375cd529972a0f94e9fa7

    • SHA512

      713a8515ed9f1ab509317593ac7b0b793af62b78a8d744bc532332d07f735b017e260872a1d0b77af14a1f753bd15c121d52a6a09f293f0e322f6313aec28216

    • SSDEEP

      768:3dKk9oVQUzoxVJt76NHRVFr9jcaIOjhBbS:NKD/y97QHDFr9jOOjve

    Score
    10/10
    xwormrattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks