Extracted

• • Target

    XClient.exe

  • Size

    58KB

  • MD5

    0b664dbbbb3530b7f6bef9b1d61addb9

  • SHA1

    9f5d5bd42ec1c44db3274396754db0c46ac169a5

  • SHA256

    48d74602d8e488f13359a7c54e4ff30e3e48d44190e57153539207b57a0f3ea4

  • SHA512

    6adff37cac5cc056f17c63b7cfefe6d7d4ab1da19ca3c5b59cbf22ead471e3c7416ff2b70eaf8be81af77dffabbd521aa563296eef6297e1e71bcbb42f9293cf

  • SSDEEP

    1536:NELc8UB3jYNK6stQKEHSWcagrR4Zb/sordrmt69O0b0BQ5O:mLvUtYVTKEHSWcNR4Zb/JdO0b0BIO

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1