General
-
Target
XClient.exe
-
Size
76KB
-
MD5
6484bbee23085846bad29aa0e60b728c
-
SHA1
cc7fc57276119183a312559202d4bd1951a33bc6
-
SHA256
1fbe596ee4f91de68d5a94fc5d856a22229ccbba67da193126383c10dd635744
-
SHA512
5b2b832df30c0b59cc98c1e940feeb7b79e15c1801ee1a471d5c63c5d4273dc72294d6a994be28e9c022574e0dbc3c17a8c01efd0fd4fee13668dcc9e2262659
-
SSDEEP
1536:SLkynUCk0gi6/ToPO7Le3Fpw5ZXIX8bcCLtuigrCld66jTeh/Gm0eOwNR0:SLklCk0G/syLFZXIX8bcKoSldqh/GHeg
Score
10/10
Malware Config
Extracted
Family
xworm
C2
main-although.gl.at.ply.gg:30970
Attributes
-
Install_directory
%AppData%
-
install_file
XClient.exe
-
telegram
https://api.telegram.org/bot7208700451:AAHHz5xWybJ91pH6F9vJRw8dcMEBlRiBXKs/sendMessage?chat_id=6131620354
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
XClient.exe
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections