General

  • Target

    XClient.exe

  • Size

    72KB

  • Sample

    240530-b2lytsah34

  • MD5

    4687edb47f66c42395805ab5d1c005c1

  • SHA1

    5e73b1ee9bd8ece54ac0f49266dcf15a901a52bd

  • SHA256

    e03842270991c28c9dc59f1a3fd4bba0883fc03d51fd8e64e02c47a324ea6db9

  • SHA512

    8d8995a780088b6948c59eb346943d3bb5889f36e9a28b01a047fbf330a919b5d8f5f561604eef8ddaefd62b056508b8bf5bb8de971cd06bc5a8323cb942187c

  • SSDEEP

    1536:B1BXExLk4h7lc2NVRNqrwnK+bdfLxvn2Hq6O6s5JFpETk:B14XhysDNqrb+bdftAq6O6yJFpYk

Malware Config

Extracted

Family

xworm

C2

127.0.0.1:2421

tel-form.gl.at.ply.gg:2421

Attributes
  • Install_directory

    %AppData%

  • install_file

    discord.exe

Targets

    • Target

      XClient.exe

    • Size

      72KB

    • MD5

      4687edb47f66c42395805ab5d1c005c1

    • SHA1

      5e73b1ee9bd8ece54ac0f49266dcf15a901a52bd

    • SHA256

      e03842270991c28c9dc59f1a3fd4bba0883fc03d51fd8e64e02c47a324ea6db9

    • SHA512

      8d8995a780088b6948c59eb346943d3bb5889f36e9a28b01a047fbf330a919b5d8f5f561604eef8ddaefd62b056508b8bf5bb8de971cd06bc5a8323cb942187c

    • SSDEEP

      1536:B1BXExLk4h7lc2NVRNqrwnK+bdfLxvn2Hq6O6s5JFpETk:B14XhysDNqrb+bdftAq6O6yJFpYk

    • Contains code to disable Windows Defender

      A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

    • Drops startup file

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks