General
-
Target
XClient.exe
-
Size
46KB
-
MD5
f057994465d01526751fd54b2d51211f
-
SHA1
6c5f8b5f144cb461c423a19e19b80c7592da2adb
-
SHA256
fe3147f86b26fd633dc86f6104010d34326fa015e1cc1cb44c6e13dfadf5842f
-
SHA512
ce9fe02b419029708fd1c9ad57fbb678a741c60948c8e75ef51e221b5adf7b2bd27d7a9aedb81d8910f3b443804d5fec8016f928ceb606fd367fa7aea8878ad0
-
SSDEEP
768:YnxE3+8AgNT7IqTpGhJduILzFh0gFEPI9O0Lr68Ouhvzj09:Yn2+86JtXFr9Zn68OuJW
Score
10/10
Malware Config
Extracted
Family
xworm
Version
5.0
C2
users-bikes.gl.at.ply.gg:60963
Mutex
gkvCDExYHD5vnCdW
Attributes
-
Install_directory
%Temp%
-
install_file
solara.exe
-
telegram
https://api.telegram.org/bot7146936438:AAE_9wNhZKkwFCU2TNwhMIogBHJX_-QiQso/sendMessage?chat_id=1380863399
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
XClient.exe
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections