General
-
Target
XClient.exe
-
Size
76KB
-
MD5
20e1e5e3bbf0a01a30941cc12733c2da
-
SHA1
fced9d178bb03d5ed6bc2b0dc57befd9baed0e08
-
SHA256
cd9850775a2bcc775a334e3893f9e5f994fdbd35d8d3715afebec5cd0415c74c
-
SHA512
3642ca896b7fa00baf455d0764326ca6b8dab6d66bc743af8903c3937acfee7462b7964f98d340285edf3810c1f982a36f4911d7c74ab4ed8d5e8f4612feda12
-
SSDEEP
1536:5nstrkdd0P9rvnau2jsw84fP+uNu9b1KES9o//6U5VOHUQu5n+x:Kto+rCd2l9b1Kty5XOHU5+x
Score
10/10
Malware Config
Extracted
Family
xworm
C2
193.161.193.99:1194
Attributes
-
Install_directory
%AppData%
-
install_file
USB.exe
-
telegram
https://api.telegram.org/bot7704029346:AAHPre1lXQa0UfPCpOUXJZ9UXA9mFxvH4Gk/sendMessage?chat_id=7590668020
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
XClient.exe
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections