Overview

overview

10

Static

static

10

XClient.exe

windows7-x64

10

XClient.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    XClient.exe

  • Size

    46KB

  • MD5

    d6d77101789a8bd6efc70bfad05092d7

  • SHA1

    4e408d292bf6f8b475c7d170f022f90dfe036d25

  • SHA256

    c5ab949a378c0995ec1df3b81ec55b4801e4bbd9cf999844469ad07ddc4cabbb

  • SHA512

    f799dc53bc35dc7b22977523ab5c3a45fafaf89dceca6db28bb38bf9a8afd919d751bb1398939d09308b0905e45cd1ee82c6378219995d3e424b260a0b6e8d93

  • SSDEEP

    768:PN2tQReCMaD2lpaHWI8ecfcLYjMeIDgFEPa9c6G6iOChxzjivQ8:PNkqe2xWLEcFFJ9NG6iOC7e48

Score
10/10
xworm

Malware Config

Extracted

Family

xworm

Version

5.0

C2

easy-results.gl.at.ply.gg:52467

Mutex

fzLm3zdk0Lxb1Zzd

Attributes
  • Install_directory

    %LocalAppData%

  • install_file

    svchost.exe

  • telegram

    https://api.telegram.org/bot7182610893:AAHBtNIrJfM5ew_EbHDwB8zi4gEiJCLGR68/sendMessage?chat_id=5296548907

aes.plain

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm family
    xworm
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • XClient.exe
    .exe windows:4 windows x86 arch:x86

    Password: Orbitchel_221_

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections