Extracted

• • Target

    XClient.exe

  • Size

    79KB

  • MD5

    e75cd40b330ca27c53ad8adefa31945c

  • SHA1

    09c81abe659f3c5878414034da93abe594db6d94

  • SHA256

    77b137f35801187a1a535c39b3b5dd78c230162b340e4aaadfb257436ac49f0a

  • SHA512

    434df96dd9fdb74aa9f312ed72534c96685afb405c7553ece45efd4a4a4fd5e9bd4a551eb37058098a9633c4ef7c187e2e8525c6e0a5b00fc706f11a257aad13

  • SSDEEP

    1536:ll6VVj22yBq/RVoRWJ11bvEEHK7M6hOApu17y2in+x:GjXBJ11bvK73OApu5yd+x

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2