Overview

overview

10

Static

static

10

XClient.exe

windows7-x64

10

XClient.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    XClient.exe

  • Size

    63KB

  • Sample

    241203-ylzw3swphq

  • MD5

    e5d6416413b58e67bb2bbb6c51147f40

  • SHA1

    a83ba972fd4805d701a9e70f05ea4c8dda2b4370

  • SHA256

    36936d13617beac8998df14e404239e7d981b4075ab95f286c17c17301910611

  • SHA512

    0b0463c4684bac141343ba205f9aacb3b3481649c84740db3c99b6b9755090d0fb3ff2313a85b2486a8a6aa584a6467c0c4dfdaf4482b446257498ad20d8ac13

  • SSDEEP

    1536:8tfrnzanA9f9s3Hb0miHEhN/GWYTzif4OmFgIeVA/:8xjzt9WXb0yhGWSGf4O2VgA/

Score
10/10
xwormdiscoveryrattrojan

Malware Config

Extracted

Family

xworm

C2

activities-consist.gl.at.ply:16814

activities-consist.gl.at.ply.gg:16814
Attributes
  • Install_directory

    %AppData%

  • install_file

    celex.exe

Targets

    • Target

      XClient.exe

    • Size

      63KB

    • MD5

      e5d6416413b58e67bb2bbb6c51147f40

    • SHA1

      a83ba972fd4805d701a9e70f05ea4c8dda2b4370

    • SHA256

      36936d13617beac8998df14e404239e7d981b4075ab95f286c17c17301910611

    • SHA512

      0b0463c4684bac141343ba205f9aacb3b3481649c84740db3c99b6b9755090d0fb3ff2313a85b2486a8a6aa584a6467c0c4dfdaf4482b446257498ad20d8ac13

    • SSDEEP

      1536:8tfrnzanA9f9s3Hb0miHEhN/GWYTzif4OmFgIeVA/:8xjzt9WXb0yhGWSGf4O2VgA/

    Score
    10/10
    xwormdiscoveryrattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Xworm family

      xworm

    • Drops startup file

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks