Overview

overview

10

Static

static

10

XClient.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    XClient.exe

  • Size

    40KB

  • Sample

    250303-1tg3cazr19

  • MD5

    0334587017d74807b00251f1ab0183dd

  • SHA1

    cd9f7e14d8c26fcd8e069764114c067348d5d524

  • SHA256

    a1e95cccfb6877cfc5ba62ed4eaa1d7db156bc28ff8e333f23a32136ab0d2dd3

  • SHA512

    d20b6fcc0845510baeb129df06d2510d2c7d0a36d8c07241dfb8919fd63ffd0ae1ee2ae5338f6ca4d7a5720e06e33df92a0e5f2eebd12fad2ffc98868fdeae40

  • SSDEEP

    768:s61VuM53Kd5DbsObdC/21RXAFx9k2lbl6iOwhlLZIoE:JVuMgvDlpCdFx9DlB6iOwLNE

Score
10/10
xwormrattrojan

Malware Config

Extracted

Family

xworm

Version

5.0

Mutex

DJkJFbiBItvqYGuP

Attributes
  • Install_directory

    %AppData%

  • install_file

    svchost.exe

  • pastebin_url

    https://pastebin.com/raw/hqEh9cLB

aes.plain

Targets

    • Target

      XClient.exe

    • Size

      40KB

    • MD5

      0334587017d74807b00251f1ab0183dd

    • SHA1

      cd9f7e14d8c26fcd8e069764114c067348d5d524

    • SHA256

      a1e95cccfb6877cfc5ba62ed4eaa1d7db156bc28ff8e333f23a32136ab0d2dd3

    • SHA512

      d20b6fcc0845510baeb129df06d2510d2c7d0a36d8c07241dfb8919fd63ffd0ae1ee2ae5338f6ca4d7a5720e06e33df92a0e5f2eebd12fad2ffc98868fdeae40

    • SSDEEP

      768:s61VuM53Kd5DbsObdC/21RXAFx9k2lbl6iOwhlLZIoE:JVuMgvDlpCdFx9DlB6iOwLNE

    Score
    10/10
    xwormrattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Xworm family

      xworm

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1

MITRE ATT&CK Matrix

Tasks