Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

XClient.exe

windows7-x64

10

XClient.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    XClient.exe

  • Size

    63KB

  • Sample

    250309-xcbx8axzb1

  • MD5

    1b9926e30f0394cd04f63941b8e6cf49

  • SHA1

    7defe51db8b48965029f8513fba175c331f996e3

  • SHA256

    42bee7f2846373821177fea425ba800b065f371c41b5183cbe0876dfb6b7d59d

  • SHA512

    f50e5a8ddbd1afbe2da90a7bebee0c1f071d83847ae2f6d6b91e40d1d7cdc8b4a1c5609c231336ff301071c9fb50e5b17e1d6d3e2fbe004fd6f976c0eedb3d9d

  • SSDEEP

    1536:3Zd+dmVe5gzeNIU5hgJbRClKTfRjOA0W6om3OSzGnF/:JdsN5h0bRIWx+OSz0F/

Score
10/10
xwormrattrojan

Malware Config

Extracted

Family

xworm

Attributes
  • Install_directory

    %AppData%

  • install_file

    RobloxPlayerApp.exe

  • pastebin_url

    https://pastebin.com/3fb4G3C5

Targets

    • Target

      XClient.exe

    • Size

      63KB

    • MD5

      1b9926e30f0394cd04f63941b8e6cf49

    • SHA1

      7defe51db8b48965029f8513fba175c331f996e3

    • SHA256

      42bee7f2846373821177fea425ba800b065f371c41b5183cbe0876dfb6b7d59d

    • SHA512

      f50e5a8ddbd1afbe2da90a7bebee0c1f071d83847ae2f6d6b91e40d1d7cdc8b4a1c5609c231336ff301071c9fb50e5b17e1d6d3e2fbe004fd6f976c0eedb3d9d

    • SSDEEP

      1536:3Zd+dmVe5gzeNIU5hgJbRClKTfRjOA0W6om3OSzGnF/:JdsN5h0bRIWx+OSz0F/

    Score
    10/10
    xwormrattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Xworm family

      xworm

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks