Extracted

• • Target

    XClient.exe

  • Size

    83KB

  • MD5

    5a285bcbc499dd2dd13e00a12b0198fb

  • SHA1

    512e32a423772ef3cc6f0169b6f4b0f9374ce4fe

  • SHA256

    f48b94b60d4ed824d07b5eb363802eb0ab344c980296b92a1d6a48a5e6f97ffa

  • SHA512

    ac19715d2949c79545604c5088622c6ba05ec6ee7e61cf22a37c358824663303bc4363018731bcbde78f7608cd04cf9005fafb48784448f58929e54deaaadfd8

  • SSDEEP

    1536:fta5sXylMDLY1ibi3PIrxT/f7p416Ilt8reOitY/El/36D:lkvlMqibigt/fVVreOitY/Edo

  Score

  10^/10

  xwormevasionexecutionpersistencerattrojan

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Disables Task Manager via registry modification

    evasion

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1