Extracted

• • Target

    XClient.exe

  • Size

    78KB

  • MD5

    a25ac87d1fea176e553d1892811b8c8d

  • SHA1

    9b624bebe8d344209f6c3d4fa160becb9a3e11dc

  • SHA256

    474c6f3085668a490c022349ebae846ec861c7842500e92f8ffa45d4f78ce10b

  • SHA512

    7a137d4ccc1766351f2ea1a20f4866491b36edaff4902c54d5edf1b69fe22fcae200a14a8d779fbb439f190bd070e91e2bdcbd7b7d2b508901167586a4b31db6

  • SSDEEP

    1536:MeQgyB1wb3whRLC7CkbPOOsexl6FdyOGL8jRBYb:Bp61wbKkbPumOGL8jRBY

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence
  behavioral1behavioral2behavioral3behavioral4