Extracted

• • Target

    bXClient.exe

  • Size

    42KB

  • MD5

    1197a13638ec84ea69c38d0a789a66a2

  • SHA1

    fc65c04ec53a09606c15055a7edc4a083190a418

  • SHA256

    12983048e2e21778b6db353a833f6ecd6a9745c2818d0968f9c882b1806681c1

  • SHA512

    12f62b6cea4f6346129d6c589d557d1481e43e749ebbd5d264ac925140da4b277560d4d75453a58847ad651562b5b230cd0650e968461a0f360054ec58b89fe5

  • SSDEEP

    768:g/CsBpA2DYSPd6ls3AyZrl2F59g8qZOCh60R8lE9:g/C2d40wF59g8qZOCU1E9

  Score

  10^/10

  xwormpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2