Overview

overview

10

Static

static

10

XClient.exe

windows7-x64

10

XClient.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    XClient.exe

  • Size

    46KB

  • MD5

    ff34583d0165edae38215cab6e6a3e4e

  • SHA1

    af016cf1218a9fe45c91ad269696a101c04eb039

  • SHA256

    1e2179f0fb074a350d2df8badbeb6721dcbe0abe62cf47eceda53dafd3eab42d

  • SHA512

    74c7f80254cde00a89843be9e6e6e10e2e21e648814edf7537ffc3059541dfe3d22f52d2dbe66ab1f7c9c65b52f4b2ca7c8234757523bddf738dca756e4553d5

  • SSDEEP

    768:kPyEHgnJN3nBQdLw4mMufoqt23P0N/7aM1eY7jFEPa9eiN26iOChnzgiWh:MtHS6m4fAaveFJ9nN26iOCFBWh

Score
10/10
xworm

Malware Config

Extracted

Family

xworm

Version

5.0

C2

https://pastebin.com/raw/wrkuHfrq:123456789

Mutex

47o7VS7SchVAcHml

Attributes
  • Install_directory

    %LocalAppData%

  • install_file

    Raketka.exe

  • pastebin_url

    https://pastebin.com/raw/wrkuHfrq

  • telegram

    https://api.telegram.org/bot7182610893:AAHBtNIrJfM5ew_EbHDwB8zi4gEiJCLGR68/sendMessage?chat_id=5296548907

aes.plain

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm family
    xworm
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • XClient.exe
    .exe windows:4 windows x86 arch:x86

    Password: Orbitchel_221_

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections