General
-
Target
XClient.exe
-
Size
78KB
-
MD5
f304f5522655bcc6b8cd42e8cc5257b2
-
SHA1
348c7528cdf90e81ed68b8539d9992da130880ec
-
SHA256
929680b8659e4c1c1211bfa32862fe648a37a030136f6d4e3d343531582f60a1
-
SHA512
f4e3131a9caed15e84032c6ff3ae5862340596c7759b52782b8816f4fd5b26335d0a48ab9ad715158dbc0a7679cecfec869453292aca23851ad569674959274c
-
SSDEEP
1536:yXXX4+cmalnBwczCKH6eIPYDlgSvLJahib3nPtCbEiUv5my6oOf/OCc2en+C:yIGQnBwI7aN2nvNb3nwEiUB0f/O/l+C
Score
10/10
Malware Config
Extracted
Family
xworm
C2
blood-pattern.gl.at.ply.gg:24558
Attributes
-
Install_directory
%AppData%
-
install_file
USB.exe
-
telegram
https://api.telegram.org/bot7704029346:AAHPre1lXQa0UfPCpOUXJZ9UXA9mFxvH4Gk/sendMessage?chat_id=7590668020
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
XClient.exe
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections