General
-
Target
XClient.exe
-
Size
81KB
-
MD5
fa26e7b6aced765ac2df5a0178f558eb
-
SHA1
71e0ea2f1ea09999fffe1615345ff8b72f7e9b59
-
SHA256
a17f1c6a8aae506a53b296ff747f3e16698a767ab58d3286c0ea7e0f0e8770b7
-
SHA512
41751d205ded76064789e2f14133abb9900b13de9f1333093da26ce0571908fe70f10a87dd4c086e033eb30241d7535d086e375dc4cc9aaa09b030e053dfe55e
-
SSDEEP
1536:d+SMyDcuUgxn9XZ01tqLCN8gMZeVFY09bO9Ve56Ym4t3uqp6Tv03OX6JYBG2jmaJ:w+3OYhgG09bO9VpRe3wv03OqJYB7jK+t
Score
10/10
Malware Config
Extracted
Family
xworm
C2
blood-pattern.gl.at.ply.gg:24558
Attributes
-
Install_directory
%AppData%
-
install_file
USB.exe
-
telegram
https://api.telegram.org/bot7704029346:AAHPre1lXQa0UfPCpOUXJZ9UXA9mFxvH4Gk/sendMessage?chat_id=7590668020
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
XClient.exe
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections