Extracted

• • Target

    XClient.exe

  • Size

    61KB

  • MD5

    1f2d7a5deda5d3d47b028f3e0820bd84

  • SHA1

    d73ae116a5eed7a7fadbff2b046336cc5e21b28f

  • SHA256

    f6df5e6ed88075cec7dfce8897314885d038e92b359edb0a2cc172b7f86749f7

  • SHA512

    9c9b02585fb24807fe830982009b89180226dde459b1e72a8fa78dc5b77052c5f203325eb9be3298fc376c9f0a0b43cbcbfc63ef57d493498b6b4966a3476cd6

  • SSDEEP

    1536:7YNqBkIQDjzm1G4nCPx5LTnBjkbvtN1TPe4WmjV6FYO7v/ah:7Yc0zm1GOCPzLrBjkbvnKwO7nI

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2