Extracted

• • Target

    XClient.exe

  • Size

    41KB

  • MD5

    238c543e188e55b1270ba6a19ea64744

  • SHA1

    d1757ef39eb202f63ce852a6d22128aa05e6b4d1

  • SHA256

    9de66e3b9fd4a3272eeb379868e2cb3c627d3fa30a2c171dceaa91464378aa83

  • SHA512

    f529cefecf2c6ab4a6dbb8e72912bd3e96db68cb696c650c74d7da020858024ae6cecc65d95c2adbba7339e135b11d17f4577a0df52ef52a76b3bf70ea5ecb04

  • SSDEEP

    768:VYjChiGFs384cu8CDkUX9cV2gQ1XEgaaDTesF5Pa9W/BOwhr3su9:sCNFs384cu889cVJMXWaZF49WJOwJV9

  Score

  10^/10

  xwormpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2