General

  • Target

    XClient.exe

  • Size

    105KB

  • MD5

    1776474422ad23624684d38269ed0683

  • SHA1

    9ac322fbcc2bd9c18fe10ab338ff50fdc91977b8

  • SHA256

    5db58c7cb9d8c1d9ec6792b2a5fa3cc38de31f9fecbecc1d4ff2f4ac3a0340f6

  • SHA512

    4431c2c6c88e3604657e710d21068724646e0f3458949aac984b62464e81f534ec8404cf4a063217074fc6563e0e8329c1ce1d61647f73255e6f487c3130fc04

  • SSDEEP

    1536:8JroawfDQDzE1yh6lsA2l+boehSoW0Nn+6dOFRGaPcUk/uoDjSBSc7UtYV8:uZDg02sAO+bounNOfGbv1W0cgte8

Score
10/10

Malware Config

Extracted

Family

xworm

C2

19.ip.gl.ply.gg:65468

speed-wheat.gl.at.ply.gg:65468

XWorm V5.2:123

Attributes
  • Install_directory

    %AppData%

  • install_file

    Delta.exe

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • XClient.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections