Static

static

10

Resubmissions

02/08/2024, 21:52

240802-1q2yca1hnm 10

Sharing

Copy URL Twitter E-mail

General

  • Target

    XClientRBX.exe

  • Size

    176KB

  • MD5

    32c3c142b5c07f856f945519c2bb0ad5

  • SHA1

    4cec2c99223886627fb33e4c6f3bfee5499fa31d

  • SHA256

    b27e94fb091340395b9d9a47652659b1e803364d7831b2a95c142692aca20cac

  • SHA512

    2e82772e2a330ddc2b16784d5d47c743e117cbd563da74204df1967a07a3bdf043bcd7f50110dbed0e89805c35dabe26bcb1851edbfe3b24679d25a9e9fa5fd3

  • SSDEEP

    3072:IfTPGJLeajzbvqDabxlOXIt9Yfe295liNgTddwY0JwsR4TbswYqkX5bEdGDOjESq:IfC9eezbxJt9YH95D

Score
10/10
xworm

Malware Config

Extracted

Family

xworm

C2

21.ip.gl.ply.gg:49171

Attributes
  • Install_directory

    %AppData%

  • install_file

    BetterRoblox.exe

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm family
    xworm
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • XClientRBX.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections