Extracted

• • Target

    XClient.exe

  • Size

    54KB

  • MD5

    f54070cb3f8967ad80f93d00a02a52ea

  • SHA1

    ddef9179a43fd625d5c3f04c8f1919379de7e480

  • SHA256

    eb8db18db280b1d68aa5aaa05d4d6f4bdfcf9921609d2c80915f8db2bb386a0e

  • SHA512

    a605105bec3ccc2d6cb204c5ef27247653abc41ff1ef5bc5e739e19dc7308f33f136c338c94683f2cd8d97458e63298dd98b36571bde261862e2a301755a8f7d

  • SSDEEP

    1536:om+BiZLw0HucpDIKBqCVzbiucbq0LSgZ6+LG8Or/1wB:keLicpEdQzbiur0LhS8OreB

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2