Overview

overview

10

Static

static

10

XClient.exe

windows7-x64

10

XClient.exe

windows10-1703-x64

10

XClient.exe

windows10-2004-x64

10

XClient.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    XClient.exe

  • Size

    59KB

  • Sample

    240629-yt46rsybpn

  • MD5

    c70a71090969c4b36bfe5082c90eddf2

  • SHA1

    8086d338ec94cd293fa399d84a6eaa8841cbd54e

  • SHA256

    2f29868f0c9863d00bc228b7acc05c532e85b9c9cdd41389983364e99889a4a2

  • SHA512

    ba02ccb41b40e38700ea3d04c8a3b1c5aac6a8a56e60e39ddfc108ad48ffcea25c65b45ae77dbe967a4c1eb01da61171afa00d142a80445342dcc5508cd6a812

  • SSDEEP

    1536:GnxjcRpnTO6q+/yJkZfA3+392F5bzlzKJ/eUOuuWOQHqu:GnQ5O6qZ+fh45bzEJFOuuW1HN

Score
10/10
xwormrattrojan

Malware Config

Extracted

Family

xworm

C2

fl-professor.gl.at.ply.gg:50715

Attributes
  • install_file

    USB.exe

Targets

    • Target

      XClient.exe

    • Size

      59KB

    • MD5

      c70a71090969c4b36bfe5082c90eddf2

    • SHA1

      8086d338ec94cd293fa399d84a6eaa8841cbd54e

    • SHA256

      2f29868f0c9863d00bc228b7acc05c532e85b9c9cdd41389983364e99889a4a2

    • SHA512

      ba02ccb41b40e38700ea3d04c8a3b1c5aac6a8a56e60e39ddfc108ad48ffcea25c65b45ae77dbe967a4c1eb01da61171afa00d142a80445342dcc5508cd6a812

    • SSDEEP

      1536:GnxjcRpnTO6q+/yJkZfA3+392F5bzlzKJ/eUOuuWOQHqu:GnQ5O6qZ+fh45bzEJFOuuW1HN

    Score
    10/10
    xwormrattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2behavioral3behavioral4

MITRE ATT&CK Matrix

Tasks