General
-
Target
XClient.exe
-
Size
34KB
-
MD5
612881be32de911ca452b47fafb138d8
-
SHA1
553f0102988c7d63d07ddbc3bef3987bcea02e3a
-
SHA256
d20631e4aa0ebaa9c4dcad80eff8ed2e048d977ce4a15d8e4a2aaaae62636a06
-
SHA512
60da900c5a789f173810d1ddc76dade5e843d0f1e1178021454b42c3ae872e20e5736227f5bc2c44b4010d5cb6b3be093447018af53c4cc5787d27bd6d746881
-
SSDEEP
384:vxUIbPJjRUw5sofLd6nfHIAxNFR2EguH/RzpkFXBLT0OZwEJN2v99Ikuisho8lHr:pRf5BdsfHIAxNOsH/wFo9jAUOjhrbX
Score
10/10
Malware Config
Extracted
Family
xworm
Version
5.0
C2
agency-lottery.gl.at.ply.gg:21526
Mutex
kccKSqzGOh5xNAEO
Attributes
-
install_file
USB.exe
-
telegram
https://api.telegram.org/bot7319597697:AAHEbms2pAMZzB0yEpJIAUJdEfo9KHqsC4g/sendMessage?chat_id=7534517325
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
XClient.exe
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections