Overview

overview

7

Static

static

3

XClient.exe

windows11-21h2-x64

7

Resubmissions

01-05-2024 16:35

240501-t3ng6ade53 7

01-05-2024 11:16

240501-ndh89afg46 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    XClient.exe

  • Size

    1.3MB

  • Sample

    240501-t3ng6ade53

  • MD5

    0e7dbde65ff6eb526caf5a8517b3ef14

  • SHA1

    326b1a54238ff6560dea85053bbea1c521dddd62

  • SHA256

    3a23809b4f8c295cc07fb589966ef0c695d6df61c244e28127be54874ef38ec4

  • SHA512

    f6fd535c17c5ea57eb9ee6a0f6705885b58b628801b3cd6e792da1518d5e1e490a007dbb9f1e72341ba2e60c635c2549762faed878fcdfac7633f3074dc55302

  • SSDEEP

    6144:HCvSkBoOd7x9JR0hg5efTfnxPQ6EgjDcOKeSZhzjnnpDnC5QQfWMFH6n/8sJdaTp:HCvTo+GTfnxPQlgyymKJ162d0jLifU

Score
7/10
persistence

Malware Config

Targets

    • Target

      XClient.exe

    • Size

      1.3MB

    • MD5

      0e7dbde65ff6eb526caf5a8517b3ef14

    • SHA1

      326b1a54238ff6560dea85053bbea1c521dddd62

    • SHA256

      3a23809b4f8c295cc07fb589966ef0c695d6df61c244e28127be54874ef38ec4

    • SHA512

      f6fd535c17c5ea57eb9ee6a0f6705885b58b628801b3cd6e792da1518d5e1e490a007dbb9f1e72341ba2e60c635c2549762faed878fcdfac7633f3074dc55302

    • SSDEEP

      6144:HCvSkBoOd7x9JR0hg5efTfnxPQ6EgjDcOKeSZhzjnnpDnC5QQfWMFH6n/8sJdaTp:HCvTo+GTfnxPQlgyymKJ162d0jLifU

    Score
    7/10
    persistence

    • Drops startup file

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks