Extracted

• • Target

    XClient.exe

  • Size

    67KB

  • MD5

    983d15dbf212dc756d1f81fbdf895845

  • SHA1

    af10c1d57668ec1540f09651e1536168be966b2a

  • SHA256

    28d4e6de4bd9ffa6edf364baa001c435140befa337b3663c200aaac70734dbf4

  • SHA512

    a91beb437816b6ed8e93d24e60510d14d39c85464cf848f7b2b0e30cf24b65fb7e9d15a1d434a862976e024e0c572250fdaec96080da638041f426b8e36c0188

  • SSDEEP

    1536:f84JJjnvF1wLYY+Cim2ehJvtkaI9bAElS4UH6AO8/HO0JYPfaL:fpjvFOdH8YPkaI9bAfO8PO0JGaL

  Score

  10^/10

  xwormdiscoveryexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2