Extracted

• • Target

    XClient.exe

  • Size

    57KB

  • MD5

    27bb905c590e1ca57930019d3587801b

  • SHA1

    952e5b9a51b4e14d5b05bd8c79bc856cfd1798e8

  • SHA256

    1deef2c92f4d52e4f52164a6e3709543a155327a7ef4d51fe008a7f058e578ca

  • SHA512

    91393c6cbcf9385e6130d1f82c2a8aabcd6ff7292081f1ee63c0b237fbafecd284799c705efe48724bb6965971a2a38e99fab89711b9ed69968fed233f7f8e56

  • SSDEEP

    768:1L6touM9WQVzWfVsWUnPDpbongkbPPY89Wa94ogh5bjh/EgnOh/hA/F8Etr:FGKifK/PFzkbPPYGP94oYhDOBi/Xr

  Score

  10^/10

  xwormrattrojan

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm
  behavioral1