Extracted

• • Target

    XClient.exe

  • Size

    67KB

  • MD5

    b5ea7d94e5e61976ad39908ce98d3717

  • SHA1

    23ef2cd169718cf5eb00e4a6a972888e4caff74f

  • SHA256

    8605ee7e95cfa1e4227c4d19acf8418cd18157515efda8f8ebbb7ce6eeaa7857

  • SHA512

    51c37b8c79f40bef577ee75c37471e358cdd3f80fea5477b33fdd3325f0320223aabdbd20ea7b481fafdb13316e2b4d566e4497255612581404662c3b4c7eb62

  • SSDEEP

    1536:clLmeR5RsNC/70/KlTLHYd+bk81FxJRgZ6fwQOCDPnOdNL:cpPvRQu0/KlfYd+bnaQOEPnOfL

  Score

  10^/10

  xwormdiscoverypersistenceratspywarestealertrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence
  behavioral1