Overview

overview

10

Static

static

10

XClient.exe

windows10-2004-x64

10

Resubmissions

02/05/2024, 13:54

240502-q7v61scd43 10

02/05/2024, 13:48

240502-q37n9acc47 10

Sharing

Copy URL Twitter E-mail

General

  • Target

    XClient.exe

  • Size

    233KB

  • MD5

    eeb55ebb51206268a85eedf674ed1c14

  • SHA1

    c6be81b9b1b0f0bda12839f71637d5feeb9dec92

  • SHA256

    ee6a5701fcad07ec7d6ec8f38a7732cf917ae1ad5db1017a84c8f690ecfa5be8

  • SHA512

    483342372093626081c945586f6c280d98f245fbf1e67b48ee2ee44e2c6feb742d818e391682422f69aabea16975d6e2ec4f7a8428513da6a54bd3ff03e05f04

  • SSDEEP

    3072:PjH2+u3bNhSJLOt7gp8SKfbzxcwg7es6/Vsb8VKTu549oJMfF/H9N3Ky9NzLnP:PjQ3bnLgpUhcX7elbKTua9bfF/H9d9n

Score
10/10
xworm

Malware Config

Extracted

Family

xworm

C2

127.0.0.1:31305

repair-cams.gl.at.ply.gg:31305

<Xwormmm>:1
Attributes
  • Install_directory

    %AppData%

  • install_file

    Process.exe

  • telegram

    https://api.telegram.org/bot6578988007:AAFu_t3O_pqok6QMNNCH4eXQGb8SQx8k2a8/sendMessage?chat_id=1698360870

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm family
    xworm
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • XClient.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections