Extracted

• • Target

    XClient.exe

  • Size

    53KB

  • MD5

    5496793299d1c888dfd87a790447bc84

  • SHA1

    fcff41d475c5415ea27ad63728054a07c2165c67

  • SHA256

    a8832fdd998e86f7823e93f27a98ef6d7ac44537c709adcfdd9537a53a42d3c4

  • SHA512

    b51e92e509c0ef8690c840a45aed9435c2cf21a8723e6023cffc05d1e9f9edac63a7f9a74bb676a89b840db66fa0f66fb6c2808a01fb68de108216b3fb124676

  • SSDEEP

    768:M+QiIOyhxNxGEaRiYLKhSPx2oWbpBZ5msdAWLPHHO2IhX4+zb:bQi22EKKha2TbpBHA+O2I5b

  Score

  10^/10

  xwormdiscoverypersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2