xworm | XWormClient[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
XWormClient.exe
Size 32KB
Sample260905-yacbmsff49
SHA256 cf14244fb788ca119fbc290c434897e7e928cd8b7bec19e501b92f8cabde38ae
MD5 cbc28d047ec88a5170010676d6d275db
SHA1 3361e48376b4ada8310a7ccded47e7f2a776bf37
SHA512 53545d8aada0c72097e6316e9a87b17f66ded2657489149dbb33cbe85723262d2bd2e2b22d73c2d0eb191fb7b40537affe3e88faa65dce2df4a02c7db229c4a4
SSDEEP 384:oYaJWq4Ava7Rm32oDuuw3+q5XwYeLBEwvh0FbOKTCOQS+RApkFTBLTAOZwpGd2v9:gxC3fOJ5ywvGFbO75S+VFo9jrOjhZbO
TLSH
T16CE24C4877E44312D9FEAFF02DF2710A1675E11B9823EF5E0CD4C99A2B63AC146507EA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

trojan rat xworm

Malware Config

Extracted

Family

xworm

Version

89.190.158.167:911

Mutex

x90mfbG7q12JM7dT

Attributes

install_file
USB.exe

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
sample	family_xworm

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
XWormClient.exe

File Explorer

XWormClient.exe

.exe 32KB

XWormClient.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 cf14244fb788ca119fbc290c434897e7e928cd8b7bec19e501b92f8cabde38ae
MD5 cbc28d047ec88a5170010676d6d275db
SHA1 3361e48376b4ada8310a7ccded47e7f2a776bf37
SHA512 53545d8aada0c72097e6316e9a87b17f66ded2657489149dbb33cbe85723262d2bd2e2b22d73c2d0eb191fb7b40537affe3e88faa65dce2df4a02c7db229c4a4
SSDEEP 384:oYaJWq4Ava7Rm32oDuuw3+q5XwYeLBEwvh0FbOKTCOQS+RApkFTBLTAOZwpGd2v9:gxC3fOJ5ywvGFbO75S+VFo9jrOjhZbO
TLSH
T16CE24C4877E44312D9FEAFF02DF2710A1675E11B9823EF5E0CD4C99A2B63AC146507EA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detect Xworm Payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

38830

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

XWormClient.exe

mscoree

dotnet