Extracted

• • Target

    XClienft.exe

  • Size

    78KB

  • MD5

    43dbe2e20d22fd2e51499a0428724b3e

  • SHA1

    bccb018e0388ece4e7db4d9d817d2c88ae5b6716

  • SHA256

    b38ad7b4fa51664916983ed7364a45cdf8f18d7bacbc2fe01947cf68d926e3d7

  • SHA512

    4e7b2e49fc0a23b43787e13ae6ff764988759fb7633950fdcd8321759d1a6af052f776e73061622e02686bd02b3605c784d9d7dad252363c21792e852a572090

  • SSDEEP

    1536:L6NRw9vrH7UwdhE6KZBbBe+b51yfP6s6SSOhGZeVaUvP9Ut:L2RAjoAm6KY+b/yaVO4eVxM

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1