Extracted

• • Target

    XClient.exe

  • Size

    162KB

  • MD5

    91331ecd6344f80b02ccac9760a3fcbe

  • SHA1

    572029a44d99a64fbd8ca759ddd41a3391f3abb3

  • SHA256

    c5a25cc0d10e27fab14c3563e826bef321f31c5128026b30227cddef219d2b85

  • SHA512

    5a67bb04be2f462b34e6e17208d6d6ce045c0602b6b8c6fa03564c6577e1875f33abecdcb4cc6dc302b52c23de6ac0bb8832e0a2c17e738ded74357fb7f4ae35

  • SSDEEP

    3072:I20sqx/l+bwQ/7Wb1Olk3oM5yBz65/M6If+3Js+3JFkKeTno:bA/Mbn/77y5yxBt25

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1