Extracted

• • Target

    XClient.exe

  • Size

    77KB

  • MD5

    64d362a144056d1d694cd6ac91b05853

  • SHA1

    26ff11d8079cfcbcd030c7b8ff6b468e64fe6646

  • SHA256

    20a5a326453f45148d45dae9a082cb81e94d8d6bf738b690f3108421428aba19

  • SHA512

    e3ca6dd9b7610cf56a538ca49ef39e3ac26586a998d838b75bf0e7e3690745c245327591ff129e8d9036e17fccc163177c6df19815874810b75d3c7e53d1af96

  • SSDEEP

    1536:XwAs1Jl/UONC4QRm4mUHHbPud6Xby/Kbokf38ZeXGWEt2OJoBhQVRDCP:XwAsFcEC4QRjS0by/7kfat2Oi4VJC

  Score

  10^/10

  xwormpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1