Extracted

• • Target

    XClient.exe

  • Size

    77KB

  • MD5

    53ccb4f87411090b7c5eca0527e3a7e7

  • SHA1

    b168b58c985ac4d64e344798a358125e80b43932

  • SHA256

    a1ca88a95ce465bae51ee3a88ec2167ce8a4f58355e1bad7d3dc56b9b406777b

  • SHA512

    a28964578dcdb6734a6fa2470b98e4b8f67a4e741156e44c66ebd4ab3981a635350ccafdf5968faf4913512c28578cb33c1a3ad098c6755c39a83616e8798b36

  • SSDEEP

    1536:qlxk2ZSDV0yMeN8XE21zkb6u1DIIpIPfnlbR44Fml/rg/bx6mTWOyTWLi2eJ:uxRZ2VRdNNb6ScFPtbRGtrgD5aO3veJ

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence
  behavioral1behavioral2