Overview

overview

10

Static

static

10

XClient.exe

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    XClient.exe

  • Size

    74KB

  • MD5

    ef36a6fed3a555b4aee8288dbe0143ee

  • SHA1

    b31be44e9e4767d7df123d742f32802aa343d0ec

  • SHA256

    4ab06ce2922222f591b776a0c6c332952ff24bbcf6f757692a6ed5f9b45cc67a

  • SHA512

    04d87228b20401ab5c7d36be3a217c09a413c671a28c016fa82fe5b19cf7b5579f15bf74212bd6a5fd141bb4e29897dc754bda20896323f8f60fc55a3e47a09c

  • SSDEEP

    1536:JztsRxq5z5siBUx5bW1Y9JeaSlbaeQ5FPlREgs6aDOUgyoNFffxv0:dtsRxE5sMiWG96bap9EgEDOUeNFfx0

Score
10/10
xworm

Malware Config

Extracted

Family

xworm

C2

phentermine-partial.gl.at.ply.gg:36969

Attributes
  • Install_directory

    %AppData%

  • install_file

    Client.exe

  • telegram

    https://api.telegram.org/bot7080511499:AAGFFOA3S2vvwmEy85SIMhKHrMsAdBoLR2Y

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm family
    xworm
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • XClient.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections