Extracted

• • Target

    XClient.exe

  • Size

    45KB

  • MD5

    77abcd7184817e72756a90f127af277e

  • SHA1

    0b6555207bc3ef2725352ba3f02ea611a0b4b1e0

  • SHA256

    1e834e6461c9ed8b5b96aeff4ee6c088d492b801809c11bd4374ba769a94641e

  • SHA512

    66e9fda6f0f1969e2ca6f99d9615cf7285e8dd96fe75dc989d07562f90c908a660643182150011844068f0c42d7eaabab77c00dc75e6136b40e6bd4996d5eb6a

  • SSDEEP

    768:VU0MGoO7862I0BXMqpgbgBn7lGAmFEPG9nPK6vOCh5z9is3:VU0MzK8QWb7kF19PK6vOCDAs3

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2