Overview

overview

10

Static

static

10

XClient.exe

windows7-x64

10

XClient.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    XClient.exe

  • Size

    63KB

  • Sample

    241121-tktlfstlbv

  • MD5

    c7e793eb4ecd706e0bb743ebfc5cfefd

  • SHA1

    edbac7a20618dbc8f4c4eddff7d664815bd3f29b

  • SHA256

    3ceded4f7c21a3249509252f8529c91a3649b207ff39ec12aa893b62f27f17c0

  • SHA512

    dce36f0f812aa02906e38430059ea6b0cdf9980c378009e85051394e46666cc0ac0efa3f28979b5b8d5c43364ef3e394bf3f25d58790923d40b13c66d06553df

  • SSDEEP

    1536:I4mO0hwqyPoVEGeyLk1bAAfTJeeHXyAOW+wBKd8/:IOobeymbAAfnHCAOWLBKq/

Score
10/10
xwormrattrojan

Malware Config

Extracted

Family

xworm

C2

10.0.0.136:80

Attributes
  • install_file

    USB.exe

Targets

    • Target

      XClient.exe

    • Size

      63KB

    • MD5

      c7e793eb4ecd706e0bb743ebfc5cfefd

    • SHA1

      edbac7a20618dbc8f4c4eddff7d664815bd3f29b

    • SHA256

      3ceded4f7c21a3249509252f8529c91a3649b207ff39ec12aa893b62f27f17c0

    • SHA512

      dce36f0f812aa02906e38430059ea6b0cdf9980c378009e85051394e46666cc0ac0efa3f28979b5b8d5c43364ef3e394bf3f25d58790923d40b13c66d06553df

    • SSDEEP

      1536:I4mO0hwqyPoVEGeyLk1bAAfTJeeHXyAOW+wBKd8/:IOobeymbAAfnHCAOWLBKq/

    Score
    10/10
    xwormrattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Xworm family

      xworm
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks