Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

XClient.exe

windows7-x64

10

XClient.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    XClient.exe

  • Size

    38KB

  • Sample

    250310-qdf51awtc1

  • MD5

    15d6de7cc2b9778bb454af90afe8bc34

  • SHA1

    0fe4a912d4a77bbb3c4babb7b127f08d1b45458b

  • SHA256

    935255132546b85bd86ebe97e8a5bf7576a82e7bf69d994a345ed44977321e40

  • SHA512

    44352e09ebedf270ae8af9bcb67732cad68e28e495bb15e7c1a176708ea262203e01fe042165db13c745247125eeaf17809803d2f2e807d734df10a41edfaff1

  • SSDEEP

    768:dVs8G/39vvxdnPNCx/BN7FWP99WIOMhAjIkN:dSBFpBNCx3FK9WIOMul

Score
10/10
xwormrattrojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

percent-wing.gl.at.ply.gg:20092

Mutex

qm2PdEKQDUikOFCl

Attributes
  • Install_directory

    %AppData%

  • install_file

    XClient.exe

aes.plain

Targets

    • Target

      XClient.exe

    • Size

      38KB

    • MD5

      15d6de7cc2b9778bb454af90afe8bc34

    • SHA1

      0fe4a912d4a77bbb3c4babb7b127f08d1b45458b

    • SHA256

      935255132546b85bd86ebe97e8a5bf7576a82e7bf69d994a345ed44977321e40

    • SHA512

      44352e09ebedf270ae8af9bcb67732cad68e28e495bb15e7c1a176708ea262203e01fe042165db13c745247125eeaf17809803d2f2e807d734df10a41edfaff1

    • SSDEEP

      768:dVs8G/39vvxdnPNCx/BN7FWP99WIOMhAjIkN:dSBFpBNCx3FK9WIOMul

    Score
    10/10
    xwormrattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Xworm family

      xworm

    • Drops startup file

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks