Overview

overview

10

Static

static

10

XClient.exe

windows10-ltsc 2021-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    XClient.exe

  • Size

    33KB

  • Sample

    241108-xxtnrsxgjh

  • MD5

    f943b88a67edce6b50028b113ebdb474

  • SHA1

    b593b35539e956328051dbabbe82e9bc9abab6fd

  • SHA256

    fae2a2cc5feae45051b383f830727ad01ab5129c1bbfa8274bd4787d3f69cb01

  • SHA512

    cd4ebdd586a6c2af4b96f5dcb6838a1ca16581874b912d12f83c442d7385ee58ea6742b145ce87c885344e3296a4f0a5bd2ff5405b212879b3237b9014ca8ecc

  • SSDEEP

    384:Jl+PkjD9+E5MFs7iui8L7zKM42pfL3iB7OxVqWqKRApkFXBLTsOZwpGN2v99Ikur:r+CD93W03v42JiB70lVF49jgOjhJba

Score
10/10
xwormrattrojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

NUKES-54663.portmap.host:54663

Mutex

302x7YLkTOUFD3w9

Attributes
  • install_file

    USB.exe

aes.plain

Targets

    • Target

      XClient.exe

    • Size

      33KB

    • MD5

      f943b88a67edce6b50028b113ebdb474

    • SHA1

      b593b35539e956328051dbabbe82e9bc9abab6fd

    • SHA256

      fae2a2cc5feae45051b383f830727ad01ab5129c1bbfa8274bd4787d3f69cb01

    • SHA512

      cd4ebdd586a6c2af4b96f5dcb6838a1ca16581874b912d12f83c442d7385ee58ea6742b145ce87c885344e3296a4f0a5bd2ff5405b212879b3237b9014ca8ecc

    • SSDEEP

      384:Jl+PkjD9+E5MFs7iui8L7zKM42pfL3iB7OxVqWqKRApkFXBLTsOZwpGN2v99Ikur:r+CD93W03v42JiB70lVF49jgOjhJba

    Score
    10/10
    xwormrattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Xworm family

      xworm
    behavioral1

MITRE ATT&CK Matrix

Tasks