Extracted

• • Target

    XClient.exe

  • Size

    66KB

  • MD5

    5b6d1840096a7c115a231d7d38a68090

  • SHA1

    0a560368bf1bdaaef81fdfd28f5404af29cb7362

  • SHA256

    08f25063db660d5709d349a25e15d140fce9d2dea938203a605a1a8e60cc2b31

  • SHA512

    062da15392c05ae52164675823287e9cef5ed33220c284d125898f74092affddd939562394fb13f0bca008297b231a35fdaa87e289317b4d0cc4b5294ff937ff

  • SSDEEP

    1536:am47QrYisUPpk+CSwnukgwbgTpT46YOBT9n+1:a3Idynxgwbg0OBJ+1

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1