Extracted

• • Target

    XClient.exe

  • Size

    33KB

  • MD5

    28dd866f286b8e9009870ccc10bf14b1

  • SHA1

    dd7594002ef8ad7287fa3771d82af461e05097c5

  • SHA256

    0935616d6f6daf035c5983316a4cfc33722f2b55720105f5f08f1c1a734cab0f

  • SHA512

    4b066c4a7a7f1fc01092b148b85dece3cc5cac405754d2a91b88d0eed590228d2e3e95d6516bc4904e0beb665c16c7b59e699a4ef5afd26356b8c236da52da5c

  • SSDEEP

    384:/l8UlK/V9FoBZ9aZV0NLx7o92lKZaJZvf/95ApkFy7BLT/OZwpGmTv99IkcisC29:dO/VMOGxwgJZvn9dFyJ9Fc2HOjhJJn

  Score

  10^/10

  xwormdiscoveryrattrojan

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1