Extracted

• • Target

    XClient.exe

  • Size

    81KB

  • MD5

    fa26e7b6aced765ac2df5a0178f558eb

  • SHA1

    71e0ea2f1ea09999fffe1615345ff8b72f7e9b59

  • SHA256

    a17f1c6a8aae506a53b296ff747f3e16698a767ab58d3286c0ea7e0f0e8770b7

  • SHA512

    41751d205ded76064789e2f14133abb9900b13de9f1333093da26ce0571908fe70f10a87dd4c086e033eb30241d7535d086e375dc4cc9aaa09b030e053dfe55e

  • SSDEEP

    1536:d+SMyDcuUgxn9XZ01tqLCN8gMZeVFY09bO9Ve56Ym4t3uqp6Tv03OX6JYBG2jmaJ:w+3OYhgG09bO9VpRe3wv03OqJYB7jK+t

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2