Extracted

• • Target
    XClient.exe
  • Size 71KB
  • SHA256 8e6a1ef0257f98ada6c7eb9425d0211dced8368795613771998bd3bd510ac1e1
  • MD5 1dd48d185245b889afabab3648238dbb
  • SHA1 d0d3f8ca8ddf3f8770690d84195e6bee49cb3623
  • SHA512 96315d58f8878230e9fd195008fa96e5883673bcd832bea6ba842f104495bdc19e8317d9673153cd68b2db8bfec4237324e1265a27fcf1ba9cba7ebcd4db1041
  • SSDEEP 1536:zzXdgEmYWm8eYBPz+tbdE6hu66YnCJO7w0tf7qqzL:3ootbdCbOU09vL
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2behavioral3behavioral4