Extracted

• • Target

    XClient.exe

  • Size

    35KB

  • MD5

    f5353c9e72508e5ee45fdd009e6b43db

  • SHA1

    2fe825365aa07e610c1ba85d54c5f0d171750c04

  • SHA256

    dd234898a4e49168729350bc7442acd77f35d53eede8edbb268cdec2a48bf774

  • SHA512

    7bae76390749284f2ec904d5818786bd45bb382be2cd2782af7d6fd4b0aeeac71db14946a6d486da0956e0b29a391d614a39bc23f88ad2713e926c964a2be560

  • SSDEEP

    768:SHs7Dzumj2frksy1TxVP+sVFyw9b2O/hDy8j:SM7DzumnpSKFr9b2O/Bxj

  Score

  10^/10

  xwormbootkitdiscoverypersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Drops file in System32 directory

  behavioral1behavioral2