Extracted

• • Target

    XClient.exe

  • Size

    50KB

  • MD5

    fceed5f165bc95503b1c9314ff7ec459

  • SHA1

    c62b48cb6728bbe7e9aeb74c9398c4bb6666f1e3

  • SHA256

    429c847c13edb9c836b9fa6a8a1481ff24754d3ef0ceb6f2d86f475e2574bd02

  • SHA512

    f149191a07b91419446e7bee755545a95171c8a30439e2e53604b9262098415c478656f8793931d9f947bb64822cd263cc6a845344841c31fe8bf0ec3195ab08

  • SSDEEP

    768:NiKph0KQHQPbe+rNh3+W4dF8EUWb7YIq78OMOV6hU81Kj:NiKp+pmee1+988b7YkrOV6PKj

  Score

  10^/10

  xwormpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1