Extracted

• • Target

    XClient3.exe

  • Size

    70KB

  • MD5

    77781292b1c20c23ca682f191cb3ec15

  • SHA1

    da8a5616abfd7e0b5669a053a112a806dfe57c44

  • SHA256

    d82b1bf22798583ee212ba706427f44dc05efee6732170d3926908fd5d5818fa

  • SHA512

    99ee3a0512c7aef25576d2a4cb73ac6afa7493709d91f97602de6279cc66b1ce4fe06e4f35396126283fd0401d3d3df19d47f434fb175c6168aebdb2688b4e76

  • SSDEEP

    1536:XsNM9CfiqNRbm2WRsdK9Y+bYDlwKeV068rfkOiXDlK:XuM9U/m2W/G+bYDa1ozkOiTI

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2