Overview

overview

10

Static

static

10

XClient.exe

windows7-x64

10

XClient.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    XClient.exe

  • Size

    32KB

  • Sample

    241121-tnn55stlcx

  • MD5

    69fd4b2c424165a6335640a575e6b88b

  • SHA1

    ffc801ec99ed46b72caea761fed13d0e85a9b5c2

  • SHA256

    2003fb3946dac6fd33d26c68651ffbb7d6d0b79a84d678a03ea5fb0ed9cb89c7

  • SHA512

    544857d2cdfe72e8b3d50675702878e990fa2148ae1e2d1dc7abc7b7aece8c59939fa85c48222b4ca68dc317327c4ca7e3aebd4260cf871ed9ed345517a6a744

  • SSDEEP

    768:fVa+vNtg+PB93Tw4e1dVFE9jwBOjh0bNs1:XvNtgw93U4epFE9jwBOje61

Score
10/10
xwormrattrojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

10.0.0.136:80

Mutex

8a8z21q7nOh4kWyg

Attributes
  • install_file

    USB.exe

aes.plain

Targets

    • Target

      XClient.exe

    • Size

      32KB

    • MD5

      69fd4b2c424165a6335640a575e6b88b

    • SHA1

      ffc801ec99ed46b72caea761fed13d0e85a9b5c2

    • SHA256

      2003fb3946dac6fd33d26c68651ffbb7d6d0b79a84d678a03ea5fb0ed9cb89c7

    • SHA512

      544857d2cdfe72e8b3d50675702878e990fa2148ae1e2d1dc7abc7b7aece8c59939fa85c48222b4ca68dc317327c4ca7e3aebd4260cf871ed9ed345517a6a744

    • SSDEEP

      768:fVa+vNtg+PB93Tw4e1dVFE9jwBOjh0bNs1:XvNtgw93U4epFE9jwBOje61

    Score
    10/10
    xwormrattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Xworm family

      xworm
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks