Overview

overview

10

Static

static

10

$77Client.exe

windows7-x64

10

$77Client.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    $77Client.exe

  • Size

    56KB

  • Sample

    241109-cadc2svcnd

  • MD5

    499308c111f6aedc6fc71df066aa3bdd

  • SHA1

    edafc28b68a50f1bb3aa49141d64f43618cf8ea6

  • SHA256

    e4d4485983a7e13e57f917476bad64d0d4812b9041c86b07f9dddd7a93c61c87

  • SHA512

    ac40f8408328d24fe33a9ce03d1c2b87bb3dec5f063e58b2f53942e701126804f8ad71708a938b8e88465a968e8ecdec61930475b7bb6716945ffcb2f4de198a

  • SSDEEP

    768:DwoQxEyV72/68RXclX7Yq0QgW+79bk1klbAvdXAypaTCqt68vTXqJ1uOiz4s/bYi:DYKGUrMFY9bk1kU8vx

Score
10/10
xwormdiscoveryrattrojan

Malware Config

Targets

    • Target

      $77Client.exe

    • Size

      56KB

    • MD5

      499308c111f6aedc6fc71df066aa3bdd

    • SHA1

      edafc28b68a50f1bb3aa49141d64f43618cf8ea6

    • SHA256

      e4d4485983a7e13e57f917476bad64d0d4812b9041c86b07f9dddd7a93c61c87

    • SHA512

      ac40f8408328d24fe33a9ce03d1c2b87bb3dec5f063e58b2f53942e701126804f8ad71708a938b8e88465a968e8ecdec61930475b7bb6716945ffcb2f4de198a

    • SSDEEP

      768:DwoQxEyV72/68RXclX7Yq0QgW+79bk1klbAvdXAypaTCqt68vTXqJ1uOiz4s/bYi:DYKGUrMFY9bk1kU8vx

    Score
    10/10
    xwormdiscoveryrattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Xworm family

      xworm

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks