Extracted

• • Target

    XClient.exe

  • Size

    81KB

  • MD5

    b802ae101004f45cfd32a900b94a86ca

  • SHA1

    a719fb0b493c258c836e0fe7c305e01692d60240

  • SHA256

    ff16df69039d6329aebb2adf7396ed766e253ab58a9aa096906a3c7e40d4793f

  • SHA512

    fe0824d2a94f72899af3fd4016be14ba25d144b2bf0f4b6d6c59f21d06eefb8283699495b1d0ca79541b2777f42649cb6522e407b52b342892e61cb104b4e659

  • SSDEEP

    1536:k0NvSBCg9qehAGGlaODmvk+bL6ruzaSq6EH0EOXTQEtKSLSTdS1EAd8IIR:k0N5g9bevI4ms+bL6uaSIHhODztX+gE7

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence
  behavioral1behavioral2