Extracted

• • Target

    XClient.exe

  • Size

    41KB

  • MD5

    4a85a8fd8d30e43227a2eeafb180b649

  • SHA1

    89c5f32f587eaf749c6b8fc4eaaf890bc0ff6928

  • SHA256

    ef5cb311599cd04871fa56f516e56af8da03d605013367021d99e1af0db876f1

  • SHA512

    1a48b86c97ad617839169601cb149b7d823ebfe07b59537c46934a57cb74e067ee36f1365f8dd568364b8fd6c899eecb1023fcaeb4f38715a1e17dda9a8906a7

  • SSDEEP

    768:nNreDweeLOoHdSgDder3XvggggQLJF5PG9pmOH6vOwhp3Euzl:n4DweQldSgDIjXvvggCFI9A46vOwLNp

  Score

  10^/10

  xwormpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1