Extracted

• • Target

    XClient.exe

  • Size

    181KB

  • MD5

    54be25948cde668a9f0a31efbea79238

  • SHA1

    e00cd0d4865b2fc3805803c1c5450d07907b3aec

  • SHA256

    33a182216fc7373b3a6bd7f0072d2be15dda0be8d87ab7cdb5efd059814a0bf6

  • SHA512

    6813b95fc6736d12bd070afadd4db12bdde00f54423315ba21f2522f5893d095f41930509a5b91b20ee3f74af5ff39598b2ec87cad4439745a15ddba30a477bb

  • SSDEEP

    3072:axyAX+bsg/AfwIOdNMf8+4NpVq8BxFRzaqF+o2GQJ7/JzqVfGvp:yub/4aB+gVqwlL

  Score

  10^/10

  xwormevasionexecutionpersistencerattrojan

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Modifies Windows Firewall

    evasion

  • Drops startup file

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1