Extracted

• • Target

    XClient.exe

  • Size

    32KB

  • MD5

    796d46d24a498cbd5c0161979b6b97ae

  • SHA1

    0bad45e27d99ab1900cbb99bd97895c2286f7c53

  • SHA256

    1e3b4846c9c304c0ea408381e99c1f80940cdd7e3d30170afd23ab492bfd5d13

  • SHA512

    0046a95e056a3e7385d46fd383e3bc48b0b6891726d2dbcb2901139af5c9d1a3bb415446fc236b68cbf0a87cc13185f6fb2604447f02228c9c1f92f67a0593d4

  • SSDEEP

    384:5YxRXcrP31VZBELRUnvJff3cdiwOURJpkFTBLToOZwxJd2v99IkuisuVFxOjhlbD:lPjgRevJ3cdIUGF/9jTOjhlbD

  Score

  10^/10

  xwormrattrojan

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Executes dropped EXE

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1