Extracted

• • Target

    XClient.exe

  • Size

    40KB

  • MD5

    7e7f6795ff9edf1d1f314f9a7a49ecac

  • SHA1

    77958bccf22102130668b3171c69da0dc3db5567

  • SHA256

    7c9045364d79647a9d12a9ccc5cd2cbc0d59d8373a7bc1fd87f191e810aab1ae

  • SHA512

    a1b178716c6a44048c1b8b9147485e173667128ec24270c637047d39bdef307c697f0e26d9d71a79fd3a82673609e0a577a5aabcbae52e0880acb0b5d8c7e4f3

  • SSDEEP

    768:IIDwCrxY4mpc9i32v6hCuuJf27ZZfFWPG9/F6OOwhljGbc:BDwCFY4gckGwCuuJfKFv9/F6OOwrCA

  Score

  10^/10

  xwormexecutionpersistencephishingrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • A potential corporate email address has been identified in the URL: [email protected]

    phishing

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1