General
-
Target
Xclient.exe
-
Size
52KB
-
MD5
7d2266eb907cc8cd2f9fbec1f6dd044c
-
SHA1
0fb05cdfd5b9d0a854ad86ea5d531ce1948d022b
-
SHA256
b93cdcf91d545e417a32ff25b0b91b50f838648e65e4444aac9d923edb8e44c1
-
SHA512
48713139c76ff268f47935a5f4e4942fae493315bf3c18ca923c7c0d636e4fbcafbfa9795b4309be4a2fb154520c69eaa73b8dbdf01a5cacec6fecd2be9bc92a
-
SSDEEP
1536:vR/0dAlFn67JjThFG9YGOO3cg64fUX8u:vJ0da67JRFG9Y1O3cghcX8u
Score
10/10
Malware Config
Extracted
Family
xworm
Version
5.0
C2
95.98.144.201:2404
Mutex
8eQL3sNKMsD3wgeC
Attributes
-
Install_directory
%Userprofile%
-
install_file
e45iasd.exe
-
telegram
https://api.telegram.org/bot6421494903:AAFuoWigwh2-oDYMZFAWqzFsbHJABidzW1Q/sendMessage?chat_id=6337292784
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
Xclient.exe
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections