Overview

overview

10

Static

static

10

XClient.exe

windows7-x64

10

XClient.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    XClient.exe

  • Size

    83KB

  • Sample

    250304-vdyr9svyby

  • MD5

    fa12aa34dcde48bb3686e2b6859beb80

  • SHA1

    7f54d77b7bde77d91a10334c29c1566b2b90c131

  • SHA256

    433736d3e79016cf79398b5666a2af9b9d63050ba31db4f8b6613eac967e5937

  • SHA512

    2229a33df94900a1d4edbe673940bf43f68e72a602bea69048b03b37c8a51529452edf5ea772ee3d65fce9861e562f940cd2e5bff58b13520064e94e4dd864fe

  • SSDEEP

    1536:sRKnhd1f0RDEZiesAUp522RA0pjb279ela6dUO4nn9XdhU:VZIYfsh5bjb2aJUOU9bU

Score
10/10
xwormrattrojan

Malware Config

Extracted

Family

xworm

C2

language-leading.gl.at.ply.gg:40494

Attributes
  • Install_directory

    %AppData%

  • install_file

    XClient.exe

Targets

    • Target

      XClient.exe

    • Size

      83KB

    • MD5

      fa12aa34dcde48bb3686e2b6859beb80

    • SHA1

      7f54d77b7bde77d91a10334c29c1566b2b90c131

    • SHA256

      433736d3e79016cf79398b5666a2af9b9d63050ba31db4f8b6613eac967e5937

    • SHA512

      2229a33df94900a1d4edbe673940bf43f68e72a602bea69048b03b37c8a51529452edf5ea772ee3d65fce9861e562f940cd2e5bff58b13520064e94e4dd864fe

    • SSDEEP

      1536:sRKnhd1f0RDEZiesAUp522RA0pjb279ela6dUO4nn9XdhU:VZIYfsh5bjb2aJUOU9bU

    Score
    10/10
    xwormrattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Xworm family

      xworm

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks