Extracted

• • Target

    XClient.exe

  • Size

    63KB

  • MD5

    babb94ecb1c83f5daa6fbe659eaaa4f9

  • SHA1

    07289ec74f35061c515c6a835160ded06f823305

  • SHA256

    c82bb2bdf2a6a156eaa280eb6cd7f006e5c2421a24490ea017e0048c5e4ab140

  • SHA512

    93fb30710c1194bad4ce6cea55df8cca3b68dcb08a53dfb68f69cf6ca0695a3f89bae0e66d3f142c5d84cb9a03cc32ac65a815c9e859a1e4c39b50dd8609e6ab

  • SSDEEP

    1536:GjFmCqZLnPN/2hFtT/PXl6/3d8/kbS5duRcdjT5WkOLuKZEY:GeZrNMF9/EFAkbS5AKZT5WkOLuI

  Score

  10^/10

  xwormdiscoverypersistencerattrojan

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Drops startup file

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  behavioral1