Extracted

• • Target

    XClient.exe

  • Size

    74KB

  • MD5

    c993fe2aacb27cf417f04ec1a2a7a0b9

  • SHA1

    05b88b752cb79c86475691b4627faf8f1610d842

  • SHA256

    fcd2edc86826bb43a8c5b0e98ea719fa311a85234c620cbb69a35112a5699e55

  • SHA512

    8542a911dcb3839ff28a22d9285ca1494c1dedc5b2dcba07954939149d39e4f47a6a2b76b1a8db756309cc3b261fde03f903f55987868882c46cfe60b1513fb0

  • SSDEEP

    1536:64S6Usxc2MdQHrL/L91JtmUbZGzaOa+Z4E6ORmp3jRO5+48cVo:6VMxc2nLL/R1J8UbZfOaXgRG3jROEl

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2