Extracted

• • Target

    XClient.exe

  • Size

    72KB

  • MD5

    9e8a941d4d61a2c3587595e25c7e2941

  • SHA1

    4784bf24413ec886c0a6d7220f0d362559b7fc0f

  • SHA256

    6910f36021f8920838c8bdb2bc5a4a6fe81ee4e3d8b2edb08b989a1e54d09bd7

  • SHA512

    2d76fc8a34b227873e96ac0ef2383802fd5e4b776219d095d9d39b25a980d9a43f07557f880de38657ee6c9e6dd26ee41293f247bf60c12a5db80562ec9c25d9

  • SSDEEP

    1536:Iij/Ykw1FGlST8m/WLRE+sxmob52WjA3AwSG6Ag+xq8ONLDVlMwj:VYMl1l9/s0obw0xwSZB8OtVlNj

  Score

  10^/10

  xwormpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2