Extracted

• • Target
    XClient.exe
  • Size 61KB
  • SHA256 a1292bb41ddd4ffa51e1f7e435b0bb7308edf7aa521ecfdfe9660dd42f556744
  • MD5 c943a5b42a5c3581ab6bf74428858a73
  • SHA1 4d7e7769f93816070a433a19fc837ceb725f7317
  • SHA512 cecffb3605f3dc05368667966f3b5cbe3e843d9549ed30dc07cf8c04b317a64ae42f75dfbc300617e589dfa98afe8b851f5fa666a68a632170cf9326e048299a
  • SSDEEP 1536:A6P+jJfmzZFm6TObE5yWHY6doOkf4xqij:A6jzDm9bEV0OkfYj
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  xwormexecutionrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2behavioral3