Overview

overview

10

Static

static

10

XClieגnt.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    XClieגnt.exe

  • Size

    58KB

  • MD5

    1746345f5fd33f0b13dee19376ce7a22

  • SHA1

    275f4029a75588c06eb121215b25cf1ddf5438e0

  • SHA256

    6843a82e9cf4912c21b513d151b1e21d7ea427d3aae206e21fd6c95a4016a92d

  • SHA512

    113262cdb9803b3759d94bac6661ddc1554a4255a42cf630d97d99e8baae5294c6e3a266210a904798c4c124654cf6b933bcfc7bb9b21d16de29482e16e6d3c8

  • SSDEEP

    1536:n7BlfGmh4KqNPbbm/8kbPX5wW3WJ6hROXrap:7HGmh41lG/8kbPeWROXrQ

Score
10/10
xworm

Malware Config

Extracted

Family

xworm

C2

sponef159-35748.portmap.host:35748

Attributes
  • Install_directory

    %AppData%

  • install_file

    svchost.exe

  • telegram

    https://api.telegram.org/bot7508868671:AAG6XIOhz39IrQIUnjub1TKVOVZHfdjpsvM/sendMessage?chat_id=6094400048

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm family
    xworm
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • XClieגnt.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections