General
-
Target
XClient.exe
-
Size
318KB
-
Sample
241030-1wx7casbmd
-
MD5
21d23bd25d4582c4891364262a330e6b
-
SHA1
95ca5cd32e86450566090a712f0622d130853088
-
SHA256
9fbe570e32d4f5e708f9915aa3d87324238196a3163fcadf68d23f0ba2ef8c8c
-
SHA512
f610ecec3e940a5b4c9f028d4bd027bdfc5fca9d168c72602c2d8cc32f6a68611d1145da8a20f6c273046af6e4347e50d1920ee2c854db40395d6b3721e654aa
-
SSDEEP
3072:2sr4iaAkbbuHWyOdt2l4mJe7UmuLchHPHo4bqRH33qGCNxxO7:Rr4pbbqBl4miUdLchvo4OlnqR
Behavioral task
behavioral1
Sample
XClient.exe
Resource
win10ltsc2021-20241023-en
Malware Config
Extracted
xworm
23.ip.gl.ply.gg:8080
-
Install_directory
%AppData%
-
install_file
svchost.exe
Targets
-
-
Target
XClient.exe
-
Size
318KB
-
MD5
21d23bd25d4582c4891364262a330e6b
-
SHA1
95ca5cd32e86450566090a712f0622d130853088
-
SHA256
9fbe570e32d4f5e708f9915aa3d87324238196a3163fcadf68d23f0ba2ef8c8c
-
SHA512
f610ecec3e940a5b4c9f028d4bd027bdfc5fca9d168c72602c2d8cc32f6a68611d1145da8a20f6c273046af6e4347e50d1920ee2c854db40395d6b3721e654aa
-
SSDEEP
3072:2sr4iaAkbbuHWyOdt2l4mJe7UmuLchHPHo4bqRH33qGCNxxO7:Rr4pbbqBl4miUdLchvo4OlnqR
Score10/10-
Detect Xworm Payload
-
Xworm family
-
Drops startup file
-
Adds Run key to start application
-