Overview

overview

10

Static

static

10

XClient.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    XClient.exe

  • Size

    32KB

  • Sample

    250302-p5manavq17

  • MD5

    7d94e01b941c37a96bd970d8a858edb3

  • SHA1

    2e11509c798ca22dc677b904e5944f68bd8386b3

  • SHA256

    f5fb868ed195b845f96a812c406f20292974b5a3c45c7a511785fbfef6af90f6

  • SHA512

    aeff8a8803ab310af275789bce86d611400ddc2b0f4639d47b234fd24fc61efe0ac23644c7298f33ab9a157e03cc825e59502e3c930773f512e0ef0b5683cb9c

  • SSDEEP

    384:WYxRXcrP31VZBELRUnvJff3cdiwJVARJpkFTBLToOZwxJd2v99Ikuis3hVFxOjhQ:OPjgRevJ3cdXVAGF/9j4Ojh9bu

Score
10/10
xwormrattrojan

Malware Config

Extracted

Family

xworm

Version

5.0

Mutex

g44V62U0yjJPmCKq

Attributes
  • install_file

    USB.exe

  • pastebin_url

    https://pastebin.com/raw/H3wFXmEi

aes.plain

Targets

    • Target

      XClient.exe

    • Size

      32KB

    • MD5

      7d94e01b941c37a96bd970d8a858edb3

    • SHA1

      2e11509c798ca22dc677b904e5944f68bd8386b3

    • SHA256

      f5fb868ed195b845f96a812c406f20292974b5a3c45c7a511785fbfef6af90f6

    • SHA512

      aeff8a8803ab310af275789bce86d611400ddc2b0f4639d47b234fd24fc61efe0ac23644c7298f33ab9a157e03cc825e59502e3c930773f512e0ef0b5683cb9c

    • SSDEEP

      384:WYxRXcrP31VZBELRUnvJff3cdiwJVARJpkFTBLToOZwxJd2v99Ikuis3hVFxOjhQ:OPjgRevJ3cdXVAGF/9j4Ojh9bu

    Score
    10/10
    xwormrattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Xworm family

      xworm

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks