Extracted

• • Target

    XClient.exe

  • Size

    230KB

  • MD5

    3cefaf94fdda7a73b1630b756856a16c

  • SHA1

    75ff4afa1db6af191464ce0a98e7b80b9c1bf41d

  • SHA256

    e05ec6d8902b50a66fd606aa22777693d280c9f6b1fa884594d533534997aa0e

  • SHA512

    bdf1d83f1a02a7c4cbebb45c61fb765d60a3e502692466fab816ca56c6f8483171101639ebad115b6edd7b8dac8212a3dcb12cfae545b13d37c3d19197b3c98f

  • SSDEEP

    3072:hOpB7PALb4mVhVVChOVC2b8SKfbzxcwg7es6/Vsb8VKTu549oJMfF/H9N3Ky9Nzr:o7ubPbbUhcX7elbKTua9bfF/H9d9n

  Score

  10^/10

  xwormdiscoverypersistenceransomwarerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2