General
-
Target
XClient.exe
-
Size
151KB
-
MD5
de4969d128c7c78563ab99f1688f6def
-
SHA1
88e2710df6de90546db25cff2cd78e27024abf9c
-
SHA256
f1456c06ee9a8a4f9180bda0abd4a3dbb2dfe23dea01b0ca9b293b86e9c097d9
-
SHA512
35ec2641fe2b22e00a3fb4e299d37028bd2628466a72d14a414b21f848c9e56c669bcfb652672f160cfc09ac2ad9098f41fd3178375d2a7433a9cc274f21a0ca
-
SSDEEP
3072:cXii9Q2Kf2lu3b+xSbLtOsUBsVlWN97u9bK6Sz0cAMSCboTiF:N+Ob6SbL0Be9G6DMz
Score
10/10
Malware Config
Extracted
Family
xworm
Attributes
-
Install_directory
%AppData%
-
install_file
\Roaming\Microsoft\Internet Explorer\UserData\iexpl.exe
-
pastebin_url
https://pastebin.com/raw/ChxziS5b
-
telegram
https://api.telegram.org/bot6809718735:AAE4t3xfzBHvyjC4zipUDbw1pc62fwQYOgs/sendMessage?chat_id=6601299789
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
XClient.exe
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections