Overview

overview

10

Static

static

10

XClient.exe

windows10-2004-x64

10

XClient.exe

windows7-x64

10

XClient.exe

windows10-2004-x64

10

XClient.exe

windows10-ltsc 2021-x64

10

XClient.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    XClient.exe

  • Size

    63KB

  • Sample

    250306-xeef5avrw7

  • MD5

    3578c1590d9470ac3b882eee69bb3422

  • SHA1

    ebd0b81c9b8797a26e9c4577aeee301316e51276

  • SHA256

    fc8c289a219fa96184110cc368c47f6cae28ad5674ae6b02679695a5fddb91d8

  • SHA512

    8b91f92352f95d5d8069a25991f6bb4bc75e0456865b78a0fa9d1bb6cf4a63cd7d36160d3b23622642a5e38769c279651be5d4f722abb229329bc38f8ffc42d3

  • SSDEEP

    1536:UHVd6f0CdkxE8DNbtDV54bUhN1pE+gdOk7N18:8r6d6xE8VtT4bULvE+gdOk7L8

Score
10/10
xwormrattrojan

Malware Config

Extracted

Family

xworm

Version

3.1

C2

today-modules.gl.at.ply.gg:45470

Attributes
  • Install_directory

    %AppData%

  • install_file

    USB.exe

Targets

    • Target

      XClient.exe

    • Size

      63KB

    • MD5

      3578c1590d9470ac3b882eee69bb3422

    • SHA1

      ebd0b81c9b8797a26e9c4577aeee301316e51276

    • SHA256

      fc8c289a219fa96184110cc368c47f6cae28ad5674ae6b02679695a5fddb91d8

    • SHA512

      8b91f92352f95d5d8069a25991f6bb4bc75e0456865b78a0fa9d1bb6cf4a63cd7d36160d3b23622642a5e38769c279651be5d4f722abb229329bc38f8ffc42d3

    • SSDEEP

      1536:UHVd6f0CdkxE8DNbtDV54bUhN1pE+gdOk7N18:8r6d6xE8VtT4bULvE+gdOk7L8

    Score
    10/10
    xwormrattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Xworm family

      xworm

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2behavioral3behavioral4behavioral5

MITRE ATT&CK Matrix

Tasks