Overview

overview

10

Static

static

10

XClient8.exe

windows7-x64

10

XClient8.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    XClient8.exe

  • Size

    30KB

  • Sample

    250307-wwbacst1dv

  • MD5

    2dc7a5a27e615f387840aa15b1fa3904

  • SHA1

    c6eb7a2cd4982506827f44d74ee0eb432b4f628d

  • SHA256

    f032527e2c7d8914827562feda746b784f275b7d7223f43833c2673b50c1f2a7

  • SHA512

    f5c385a5ed60d7305a61681a8b11a851730416b3eed8eea57a9d441dcc3d611c51f7693b5503ef5e029bb88f3b1cdfa4a1c65bb5e93aae46a476b688c9c8477c

  • SSDEEP

    768:rrgECfLHrMYAoR/iw2uBFE9RiOqh9bjp:ngRTiw24FE9RiOqDPp

Score
10/10
xwormrattrojan

Malware Config

Extracted

Family

xworm

Version

3.1

C2

stay-type.gl.at.ply.gg:46374

Mutex

jFCh809iryVGfT4C

Attributes
  • install_file

    USB.exe

aes.plain

Targets

    • Target

      XClient8.exe

    • Size

      30KB

    • MD5

      2dc7a5a27e615f387840aa15b1fa3904

    • SHA1

      c6eb7a2cd4982506827f44d74ee0eb432b4f628d

    • SHA256

      f032527e2c7d8914827562feda746b784f275b7d7223f43833c2673b50c1f2a7

    • SHA512

      f5c385a5ed60d7305a61681a8b11a851730416b3eed8eea57a9d441dcc3d611c51f7693b5503ef5e029bb88f3b1cdfa4a1c65bb5e93aae46a476b688c9c8477c

    • SSDEEP

      768:rrgECfLHrMYAoR/iw2uBFE9RiOqh9bjp:ngRTiw24FE9RiOqDPp

    Score
    10/10
    xwormrattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Xworm family

      xworm
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks