Extracted

• • Target

    XClient.exe

  • Size

    33KB

  • MD5

    66bd8238a2177758528a96b77ea090cf

  • SHA1

    17a6c0f87a9e17d4bd2220818cae3c6797a1b222

  • SHA256

    73f6543eb0648b63f8f2f0920c3fd9d968d43c367758b45a6133dd181fa81e88

  • SHA512

    ed3ee27edb2768dcf3ae71f37c451b495f518847f18bc997b92857ae15fb3bf410984ba1ff88272f6e0f3326273b2574d09946d2ea4c1135497c67069338aa54

  • SSDEEP

    384:6E8PQ9Ba+vNuntf98d6ILj7CM42pfL3iB7OxVqWmRApkFXBLTsOZwpGN2v99IkuY:EUa+vNohsXn42JiB70cVF49jeOjhabs

  Score

  10^/10

  xwormrattrojanevasion

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detect Xworm Payload

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2