Overview

overview

10

Static

static

10

XClient.exe

windows10-ltsc 2021-x64

10

Resubmissions

21-01-2025 05:58

250121-gphcrszkgv 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    XClient.exe

  • Size

    33KB

  • Sample

    250121-gphcrszkgv

  • MD5

    179482cceb10d4670100eb9a630bb311

  • SHA1

    99cbb9197c893ab46b6110d2235f91daf1d41513

  • SHA256

    2da37fb7b6f492f2075da78b374057fb94e27a80165d48a5c728ddf5d7819233

  • SHA512

    204006f23a305602fdf304f69eb74233bc0cdb8844779b3266cbdec529629f2a7840a1d18409bc251b0c39811268533334a9d3204baf3ef6804e52947ac2cc46

  • SSDEEP

    384:Tl+PkjD9+E5MFs7iui8L7zKM42pfL3iB7OxVqWqKRApkFXBLTsOZwpGN2v99IkuW:J+CD93W03v42JiB70lVF49j9vOjhWbD

Score
10/10
xwormrattrojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

46.146.46.81:7000

46.146.46.81:7000:7000
Mutex

fbhq2WHCedXyFd07

Attributes
  • install_file

    svchost.exe

aes.plain

Targets

    • Target

      XClient.exe

    • Size

      33KB

    • MD5

      179482cceb10d4670100eb9a630bb311

    • SHA1

      99cbb9197c893ab46b6110d2235f91daf1d41513

    • SHA256

      2da37fb7b6f492f2075da78b374057fb94e27a80165d48a5c728ddf5d7819233

    • SHA512

      204006f23a305602fdf304f69eb74233bc0cdb8844779b3266cbdec529629f2a7840a1d18409bc251b0c39811268533334a9d3204baf3ef6804e52947ac2cc46

    • SSDEEP

      384:Tl+PkjD9+E5MFs7iui8L7zKM42pfL3iB7OxVqWqKRApkFXBLTsOZwpGN2v99IkuW:J+CD93W03v42JiB70lVF49j9vOjhWbD

    Score
    10/10
    xwormrattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Xworm family

      xworm
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks