xworm | 54055760a388fef0cc0a080c5558f93a8865bb240bdb8c23b05e8632710b5c0a | Triage

Sharing

General

Target

XClient.exe
Size

35KB
Sample

240615-rkj1xaxcrj
MD5

ec57b7dbf36127cffc7fc2140d3f6234
SHA1

1915e95420407d218db5a339164e97bb1349c2ee
SHA256

54055760a388fef0cc0a080c5558f93a8865bb240bdb8c23b05e8632710b5c0a
SHA512

c79496b4c3a9922428e11427e1119108f19b03347fca42a486473dbe4b1fc721a416dca85db64f48186f5f5696c8ba5242e38fbe3fc8db2bb7def75aa7ddb49e
SSDEEP

768:DoHv9ouQGV3hiQfCYzZ4mVFy+9FoOjh1OEO:DoHloq3hVa6Z48Ff9FoOjs

Score

10^/10

xworm rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

modern-educators.gl.at.ply.gg:23695

Mutex

R82YeNKbOjFtJV8h

Attributes

Install_directory
%AppData%
install_file
XClient.exe

aes.plain

Targets

- Target
  
  XClient.exe
- Size
  
  35KB
- MD5
  
  ec57b7dbf36127cffc7fc2140d3f6234
- SHA1
  
  1915e95420407d218db5a339164e97bb1349c2ee
- SHA256
  
  54055760a388fef0cc0a080c5558f93a8865bb240bdb8c23b05e8632710b5c0a
- SHA512
  
  c79496b4c3a9922428e11427e1119108f19b03347fca42a486473dbe4b1fc721a416dca85db64f48186f5f5696c8ba5242e38fbe3fc8db2bb7def75aa7ddb49e
- SSDEEP
  
  768:DoHv9ouQGV3hiQfCYzZ4mVFy+9FoOjh1OEO:DoHloq3hVa6Z48Ff9FoOjs
Score

10^/10

xworm rat trojan
- Detect Xworm Payload
- Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Drops startup file
behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1