Extracted

• • Target

    XClient555exe_JC.exe

  • Size

    57KB

  • MD5

    92a0d311e7c2fa4f5b3bbdba892cd885

  • SHA1

    da5056bb9a5774225eefa911ec2ccdb1eb55bf86

  • SHA256

    2b9891de27bf63059cfc0a7a7902de60177b13a9501ee68912a19725b7575fa9

  • SHA512

    19459ec6b2cafb2f864d0a37ba06537ecbbc3e719f8e95a614f1d3343f6d40978d9f6c5d6ddfc99abfe9b77d43703150d08b126cac8294b6022d64d74cd534d6

  • SSDEEP

    768:qlh4xOhQ1UbXXDqeJQsJtY3KaS8phwrdbcZRl7BDQHHc6r3byNO2hgHa2Sc:wGohDlJXisbcZl+Hc6jGNO2xnc

  Score

  10^/10

  xwormpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2