Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

XClent.exe

windows7-x64

10

XClent.exe

windows10-2004-x64

10

Resubmissions

21/04/2024, 08:48

240421-kqlncsfg7s 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    XClent.exe

  • Size

    183KB

  • Sample

    240421-kqlncsfg7s

  • MD5

    0e69783c0f4cd6d63fe44ab4ee689a0c

  • SHA1

    70407440413d2ee26f0398e486ddbd6e8ea7c6ac

  • SHA256

    5d3302a1cec976301d4ba48e0541eea0e76623517a5b6f2c1b913cfe2ebaa8a7

  • SHA512

    95c9100bdee8ce3104be40daca0088f484ca2aa3407e7a997fb472259b3d604993cb53e2f011da4299105566285874f1534df8d22a5a2e15e1e9130943b6423e

  • SSDEEP

    3072:wfOE6EtuXq/btJOrGOnPRUGKXs+S++7KFSbxeY+qDDrM47I:fE4Xq/bv7GqStKEbxI

Score
10/10
xwormrattrojan

Malware Config

Extracted

Family

xworm

C2

safe-towers.gl.at.ply.gg:30351

Attributes
  • install_file

    USB.exe

Targets

    • Target

      XClent.exe

    • Size

      183KB

    • MD5

      0e69783c0f4cd6d63fe44ab4ee689a0c

    • SHA1

      70407440413d2ee26f0398e486ddbd6e8ea7c6ac

    • SHA256

      5d3302a1cec976301d4ba48e0541eea0e76623517a5b6f2c1b913cfe2ebaa8a7

    • SHA512

      95c9100bdee8ce3104be40daca0088f484ca2aa3407e7a997fb472259b3d604993cb53e2f011da4299105566285874f1534df8d22a5a2e15e1e9130943b6423e

    • SSDEEP

      3072:wfOE6EtuXq/btJOrGOnPRUGKXs+S++7KFSbxeY+qDDrM47I:fE4Xq/bv7GqStKEbxI

    Score
    10/10
    xwormrattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks