General
-
Target
XClient.exe
-
Size
79KB
-
MD5
e75cd40b330ca27c53ad8adefa31945c
-
SHA1
09c81abe659f3c5878414034da93abe594db6d94
-
SHA256
77b137f35801187a1a535c39b3b5dd78c230162b340e4aaadfb257436ac49f0a
-
SHA512
434df96dd9fdb74aa9f312ed72534c96685afb405c7553ece45efd4a4a4fd5e9bd4a551eb37058098a9633c4ef7c187e2e8525c6e0a5b00fc706f11a257aad13
-
SSDEEP
1536:ll6VVj22yBq/RVoRWJ11bvEEHK7M6hOApu17y2in+x:GjXBJ11bvK73OApu5yd+x
Score
10/10
Malware Config
Extracted
Family
xworm
C2
12345555.openvpn.com:4444
Attributes
-
Install_directory
%AppData%
-
install_file
USB.exe
-
telegram
https://api.telegram.org/bot7704029346:AAHPre1lXQa0UfPCpOUXJZ9UXA9mFxvH4Gk/sendMessage?chat_id=7590668020
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
XClient.exe
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections