Extracted

• • Target

    XClient.exe

  • Size

    67KB

  • MD5

    128772bf2d2e235efe53c17a09ed1548

  • SHA1

    91e722709b3c535ca5bff2af713bc3813fd57cf2

  • SHA256

    726d7aeae737ff43c3c87976096a4b8af162c49fa24f4708f93e384fb2831103

  • SHA512

    c41ae24614668304e4b2add09e1a70240a37abc43f2c5fa76619c8bc1bd3afe8aaea64aaf7b89c0135eebcec748c7204c710d85c895bbebf08363d9c086c7883

  • SSDEEP

    1536:XJgd5vY2FEWjIhcslnhtM1oxajtPAFbL7n2t2ISZ64MOBgzMQay:XQvRFVajXap4bLLk2gOBgXay

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2