Extracted

• • Target

    XClient.exe

  • Size

    41KB

  • MD5

    f5247334d09885397d3350e17f026d25

  • SHA1

    6da120a58893a2f57ebec91ce0e613e0039146cf

  • SHA256

    095dee93672ae769a9dfa9dd190a0a93cca63db43546856138bac16828a15f21

  • SHA512

    6ba58b64f1a9b4d69a6462eea7a632a92b3e9d435952bd3ce53749c1b416e9df8e0e0dd4e92a56dc00b059c721dfeab77279f8440d9a1e14ae796530a0bf78a5

  • SSDEEP

    768:HKr2/FPtKX7eRvIiWqyAuIzfjFSyratF5PG9sJaOwhI3ECz:Hhe7EI3RAuwxSyruFI9sAOw+lz

  Score

  10^/10

  xwormpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1