Extracted

• • Target

    XClient.exe

  • Size

    209KB

  • MD5

    eadc1aa28a835df09f7dcf4705b530f3

  • SHA1

    87a676d013d092ee5d56e848661a2ce311b5ba30

  • SHA256

    2a4493d76a8c8dc291e24e2276dd68423604176f0ff41edea4441c2a33e9b313

  • SHA512

    e7070aaaf32db9e6744c1c6481fe6f31ba39d34817b7c1f64be60e1a4a26afbfdc0e62e94a997f78cc11fd77653e7de48d8670aa2e5b2e4f9c8d91af249e4f39

  • SSDEEP

    3072:iWoG3NZ+b1yGpRJOfyl0fsgbcUieNJZKoPC5+LJ:iWorbkGlS/wK3ZKoa

  Score

  10^/10

  xwormdiscoveryexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1