Extracted

• • Target

    XClient.exe

  • Size

    80KB

  • MD5

    18bfa92b77cf828eef637da14eefb770

  • SHA1

    9c010b423e035c0751050bf96f61750509734029

  • SHA256

    70441672a9bdcdab038ce4944ddb852afd678f38a6058601dc3f5cd57b5bea60

  • SHA512

    de1cdaa74edf4d0604bc4625ee55ea15d627378c243b65e4cf19c9d5d28abdaafad288172ac7323d5ab1869b530f96dd553b38fe548ee6a4df4e2934fb9c3ca4

  • SSDEEP

    1536:WJmDhjyCoaQ7o7nacdQNZwKdeol9bYjZomFqW6XOmH7AHmn+k:bVjVeOnacdQEwj9bY1omFcOmH7F+k

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Drops startup file

  • Adds Run key to start application

    persistence
  behavioral1