Extracted

• • Target

    XClient.exe

  • Size

    36KB

  • MD5

    c4e5b29e6d3ac61b6a5b36b8d208bbbb

  • SHA1

    15f2cb1aa5b4413752d70e7305828f9461af0ca6

  • SHA256

    ec46b8a0e372f8062ff4f3cc8a6817543aa2781e5a6d74bf914b3b43b4f087e3

  • SHA512

    9a3ed168295db01ce5f98f59f8478d88d71744213191c4e221d761a3a79e9a281523d3b360b5bd305d7606bc4aebb80f337b18f21982f66de63a13664078c598

  • SSDEEP

    768:reVXtHcDQZS9LR50UZmx/F89Rj6OOMhdQJT:r8dH+t51OF89Rj6OOMnS

  Score

  10^/10

  xwormexecutionrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  behavioral1behavioral2