Extracted

• • Target

    XClient.exe

  • Size

    63KB

  • MD5

    2e74447298828c43f6cd6a4c656b8359

  • SHA1

    9e593f738e97b5dc4edcc3ab352b61a257a104f0

  • SHA256

    804cd41d9c68200b85e59b89a391a2f3fa88fbc1cf57666ccf891771938b4951

  • SHA512

    fffd8a88b9575a502585dd2494796cef0606817f52ea812e60e3ec600bd6e5a9ac53aa1073e2adc38bb70940d6ef0406d0c23fbabaffec7e2471c121b5442167

  • SSDEEP

    1536:yJlE+AF8qTLf1EHgEas5X8b3t747btByyszpXOvsd6yKi:yJlAhNY8b97EDylXOvsdFV

  Score

  10^/10

  xwormpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2