Overview

overview

10

Static

static

10

XClient.exe

windows7-x64

10

XClient.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    XClient.exe

  • Size

    337KB

  • MD5

    162b26363ec3fdacd60c3fd773dc8a73

  • SHA1

    145e6b6602b071a57c1466ad317356e8e3650939

  • SHA256

    42904fa667be59205858aadd515e7440a1fb89ace28eb8e76cd49125d768aef7

  • SHA512

    ab9a310ec0e63bd85c156315cd48fc8c198289d86a86744270adaa454b28da42baab33d310dc3d3e9dababc1cf9061e5d6e0df016a3ce7e6bf63e0b030fb1132

  • SSDEEP

    3072:fv3nO0vbHWKb0QBbb/4z7I3iOjhFz1Z2c40:fdWKbbAv81Z

Score
10/10
xworm

Malware Config

Extracted

Family

xworm

C2

147.185.221.21:55421

advertise-msn.gl.at.ply.gg:55421
Attributes
  • Install_directory

    %ProgramData%

  • install_file

    ohiotown.exe

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm family
    xworm
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • XClient.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections