General
-
Target
XClient.exe
-
Size
72KB
-
Sample
240530-ccmz9sbd43
-
MD5
4687edb47f66c42395805ab5d1c005c1
-
SHA1
5e73b1ee9bd8ece54ac0f49266dcf15a901a52bd
-
SHA256
e03842270991c28c9dc59f1a3fd4bba0883fc03d51fd8e64e02c47a324ea6db9
-
SHA512
8d8995a780088b6948c59eb346943d3bb5889f36e9a28b01a047fbf330a919b5d8f5f561604eef8ddaefd62b056508b8bf5bb8de971cd06bc5a8323cb942187c
-
SSDEEP
1536:B1BXExLk4h7lc2NVRNqrwnK+bdfLxvn2Hq6O6s5JFpETk:B14XhysDNqrb+bdftAq6O6yJFpYk
Behavioral task
behavioral1
Sample
XClient.exe
Resource
win10v2004-20240426-en
Malware Config
Extracted
xworm
127.0.0.1:2421
tel-form.gl.at.ply.gg:2421
-
Install_directory
%AppData%
-
install_file
discord.exe
Targets
-
-
Target
XClient.exe
-
Size
72KB
-
MD5
4687edb47f66c42395805ab5d1c005c1
-
SHA1
5e73b1ee9bd8ece54ac0f49266dcf15a901a52bd
-
SHA256
e03842270991c28c9dc59f1a3fd4bba0883fc03d51fd8e64e02c47a324ea6db9
-
SHA512
8d8995a780088b6948c59eb346943d3bb5889f36e9a28b01a047fbf330a919b5d8f5f561604eef8ddaefd62b056508b8bf5bb8de971cd06bc5a8323cb942187c
-
SSDEEP
1536:B1BXExLk4h7lc2NVRNqrwnK+bdfLxvn2Hq6O6s5JFpETk:B14XhysDNqrb+bdftAq6O6yJFpYk
Score10/10-
Detect Xworm Payload
-
Drops startup file
-
Adds Run key to start application
-