Extracted

• • Target

    XClient.exe

  • Size

    169KB

  • MD5

    5295e6e63d9ba5e51d537df2ef93a95c

  • SHA1

    8412fae03a631b2efe6cd477932872d3c75eedab

  • SHA256

    56d6e266596ba01b68c7545918cc666a2e23b5bb6878da70334b38c5cb1981fd

  • SHA512

    6175683a1c192a851b11901e3638c824fd81f7248c2901fa2cf703b1267645a6e40fdaf111ba15656ee25aba7e3ac29b34590ddb2a49356c973e2814137d2c0a

  • SSDEEP

    1536:qvDX04YtQQanlgpiUFoKkb1XMn6mVzpasWI46UZVtfvTOSRRRJxEq:qX0xYaoKkb1XHqwsW7ZVRbOSRzJxEq

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence
  behavioral1behavioral2