Extracted

• • Target

    XClient.exe

  • Size

    63KB

  • MD5

    babb94ecb1c83f5daa6fbe659eaaa4f9

  • SHA1

    07289ec74f35061c515c6a835160ded06f823305

  • SHA256

    c82bb2bdf2a6a156eaa280eb6cd7f006e5c2421a24490ea017e0048c5e4ab140

  • SHA512

    93fb30710c1194bad4ce6cea55df8cca3b68dcb08a53dfb68f69cf6ca0695a3f89bae0e66d3f142c5d84cb9a03cc32ac65a815c9e859a1e4c39b50dd8609e6ab

  • SSDEEP

    1536:GjFmCqZLnPN/2hFtT/PXl6/3d8/kbS5duRcdjT5WkOLuKZEY:GeZrNMF9/EFAkbS5AKZT5WkOLuI

  Score

  10^/10

  xwormdiscoverypersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2