General
-
Target
XClient.exe
-
Size
61KB
-
Sample
240427-m52n8shg6z
-
MD5
b8461fceafd10150db8f951e31e45686
-
SHA1
b486e21c7030ab612a2aa9fdd95aa0e37b1cea86
-
SHA256
bb05e85f2e704c3a4e496bd4069bab565859eeb0f852b1156c0c0839111a1a9e
-
SHA512
941bc2519edff833cd82fb2a41c997f358279eb360d6333c6992bff667890c4344e7cdcbb950115d65dbbade5029c850a72bd941379cc4210d4dbc0a79fc45af
-
SSDEEP
1536:2fkbca18HxOWYMagL5wOeb5UlcT6ppOKx02q:GauHxOTAYb5cpOK/q
Behavioral task
behavioral1
Sample
XClient.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
XClient.exe
Resource
win10v2004-20240419-en
Malware Config
Extracted
xworm
127.0.0.1:37915
5.39.43.50:37915
de-engines.gl.at.ply.gg:37915
-
Install_directory
%AppData%
-
install_file
XClient.exe
Targets
-
-
Target
XClient.exe
-
Size
61KB
-
MD5
b8461fceafd10150db8f951e31e45686
-
SHA1
b486e21c7030ab612a2aa9fdd95aa0e37b1cea86
-
SHA256
bb05e85f2e704c3a4e496bd4069bab565859eeb0f852b1156c0c0839111a1a9e
-
SHA512
941bc2519edff833cd82fb2a41c997f358279eb360d6333c6992bff667890c4344e7cdcbb950115d65dbbade5029c850a72bd941379cc4210d4dbc0a79fc45af
-
SSDEEP
1536:2fkbca18HxOWYMagL5wOeb5UlcT6ppOKx02q:GauHxOTAYb5cpOK/q
Score10/10-
Detect Xworm Payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-