xworm | XClientt (1)[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

XClientt (1).exe
Size

39KB
MD5

6a873712d6a11a78ae92c80bd3506dbf
SHA1

86b58f5c02c337caaa8e5ef63a98d8fb5e25aa80
SHA256

b2ab09726f90b41c8a3d9b7470ee9604dee5ea2111a052c8408a64ce6b23f360
SHA512

0210121bda5d61193f6f9d3360bef3e4cba368a1b613ddff0f068a1fd0bbebc208fabfdde2005778cbc468f1a519ce8b2ec55187165e98c5c475875ca5bca9d9
SSDEEP

768:iTaoZWIV16iwtk8qZhlYYhxST9BeY0FWPG9t4Xx6TOMhF7tybk4f8:iTaowGwtkRh9hx69BehFh9twx6TOM/h/

Score

10^/10

xworm

Malware Config

Extracted

Family

xworm

Version

5.0

Mutex

WzEGrXvnQRUR3Dij

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
sample	family_xworm

Xworm family
xworm

Files

XClientt (1).exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

Certificate

Issuer

CN=Thinkst Root CA,OU=Thinkst Applied Research CA,O=Thinkst Applied Research,C=ZA

Not Before

07/05/2024, 04:56

Not After

07/05/2034, 04:56

Subject

CN=Microsoft Windows,O=Microsoft Corporation,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageKeyEncipherment
KeyUsageDataEncipherment
KeyUsageKeyAgreement

f6:2e:cc:38:d5:61:58:c6:13:2f:96:71:21:80:47:d2:63:b9:e2:b9:92:74:7a:99:49:c0:24:9c:4a:27:a3:86
Signer

Actual PE Digest

f6:2e:cc:38:d5:61:58:c6:13:2f:96:71:21:80:47:d2:63:b9:e2:b9:92:74:7a:99:49:c0:24:9c:4a:27:a3:86

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ