Overview

overview

10

Static

static

10

XClient.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    XClient.exe

  • Size

    261KB

  • Sample

    250302-zsrpqavnw6

  • MD5

    731d3f9b7421abe1e0ca7648fc43de46

  • SHA1

    9cc2166087313ab5a19635cfb08c5207032d8f3f

  • SHA256

    8465b9c75257a7dabef1a0d339559dc6724c250078c2db6885cdd9057c6866e4

  • SHA512

    140b55febd0453f7c687fba1ddbeca1e16a47550615a097afa138bbfd9b998edebffcdb851900781c92ce1b377a4a649b2ce4a85477d64a7185c3ef19f4afb49

  • SSDEEP

    3072:kP7QWMkq0+G6OnNVJB5DQorRb80xtYFGTx9IFE3bVyTgs/jdrlRpPNxhC6bUq9bd:1vGrNAs80f/FnbMTgs/jplRJNf9b6hM

Score
10/10
xwormdefense_evasionrattrojan

Malware Config

Targets

    • Target

      XClient.exe

    • Size

      261KB

    • MD5

      731d3f9b7421abe1e0ca7648fc43de46

    • SHA1

      9cc2166087313ab5a19635cfb08c5207032d8f3f

    • SHA256

      8465b9c75257a7dabef1a0d339559dc6724c250078c2db6885cdd9057c6866e4

    • SHA512

      140b55febd0453f7c687fba1ddbeca1e16a47550615a097afa138bbfd9b998edebffcdb851900781c92ce1b377a4a649b2ce4a85477d64a7185c3ef19f4afb49

    • SSDEEP

      3072:kP7QWMkq0+G6OnNVJB5DQorRb80xtYFGTx9IFE3bVyTgs/jdrlRpPNxhC6bUq9bd:1vGrNAs80f/FnbMTgs/jplRJNf9b6hM

    Score
    10/10
    xwormdefense_evasionrattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Xworm family

      xworm

    • Looks for VirtualBox Guest Additions in registry

      defense_evasion

    • Looks for VMWare Tools registry key

      defense_evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Legitimate hosting services abused for malware hosting/C2

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks