Extracted

• • Target

    XClient.exe

  • Size

    41KB

  • MD5

    0658f349a11af82050212edf3f599342

  • SHA1

    0fa5f0818a7e50fd312f5dab4b7150de7df9fa7e

  • SHA256

    5da1772e67ac37571ed70b498e237cde750647607d4fe98fd8e7fd8668e0c0e0

  • SHA512

    0c337cf6b38a2e2c7078813c61086a173c5761f4b90efdbee85fd7edb4f16731d66a9ea95bc4988340b64e37d75b4227b224a110bb0e64fc36e076511857c3f7

  • SSDEEP

    768:TKr2/FPtKX7eRvIiWqyAuIzfjFSuDatF5PG9sJOwhU3ECN:The7EI3RAuwxSuDuFI9sJOwGlN

  Score

  10^/10

  xwormpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2behavioral3behavioral4