Extracted

• • Target

    XClient.exe

  • Size

    68KB

  • MD5

    47e0ca7830921cb0ba435b23785a9f86

  • SHA1

    7998df6ffc55c953a920f2e4b771c9332b3334f4

  • SHA256

    913e4250a41ad60478f4626a8e630f187dd454a62449fe5d690589045a58066d

  • SHA512

    c8a7ae5f64b4461d434f8aa0afbcd350485bd5b98731b717c54db57195b2bad850e47bc9ab34d6c4754fb9676c666492d5166cc643e11b4bf6a8022540aa0871

  • SSDEEP

    1536:UsiUknoCUAcE+PVCHb4hlaLS52IxUPBOr4vFFRF0Ri:UYeUAczPVCHb4gY2IcBOkFFwi

  Score

  10^/10

  xwormpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2behavioral3behavioral4behavioral5