General

  • Target

    XClient.exe

  • Size

    318KB

  • Sample

    241030-1wx7casbmd

  • MD5

    21d23bd25d4582c4891364262a330e6b

  • SHA1

    95ca5cd32e86450566090a712f0622d130853088

  • SHA256

    9fbe570e32d4f5e708f9915aa3d87324238196a3163fcadf68d23f0ba2ef8c8c

  • SHA512

    f610ecec3e940a5b4c9f028d4bd027bdfc5fca9d168c72602c2d8cc32f6a68611d1145da8a20f6c273046af6e4347e50d1920ee2c854db40395d6b3721e654aa

  • SSDEEP

    3072:2sr4iaAkbbuHWyOdt2l4mJe7UmuLchHPHo4bqRH33qGCNxxO7:Rr4pbbqBl4miUdLchvo4OlnqR

Malware Config

Extracted

Family

xworm

C2

23.ip.gl.ply.gg:8080

Attributes
  • Install_directory

    %AppData%

  • install_file

    svchost.exe

Targets

    • Target

      XClient.exe

    • Size

      318KB

    • MD5

      21d23bd25d4582c4891364262a330e6b

    • SHA1

      95ca5cd32e86450566090a712f0622d130853088

    • SHA256

      9fbe570e32d4f5e708f9915aa3d87324238196a3163fcadf68d23f0ba2ef8c8c

    • SHA512

      f610ecec3e940a5b4c9f028d4bd027bdfc5fca9d168c72602c2d8cc32f6a68611d1145da8a20f6c273046af6e4347e50d1920ee2c854db40395d6b3721e654aa

    • SSDEEP

      3072:2sr4iaAkbbuHWyOdt2l4mJe7UmuLchHPHo4bqRH33qGCNxxO7:Rr4pbbqBl4miUdLchvo4OlnqR

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

    • Xworm family

    • Drops startup file

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks