Extracted

• • Target

    XClient2.exe

  • Size

    58KB

  • MD5

    704c2e8b2d15dc2fb08fc335efd7193c

  • SHA1

    8c5b3fa11ce45792e4fd4221af6393fdd094c9e2

  • SHA256

    cb55474711d325028e8dc6dbc7162105009af685c3982c35e593fe6988d6af32

  • SHA512

    4472315bb6022570c7131cf2142972435a5233f84842382e3566abb4c37653bb550561919f9bbf639bd1a7db17a059028d2b5d479a3ece106ed85b47f8190f1d

  • SSDEEP

    1536:8uQZW2ATJmcoKMLe6FsdbaA1hQb8C6YxnO+mHm:8uQZmTJmsCj6baguO+X

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2