Extracted

• • Target
    XClient.exe
  • Size 71KB
  • SHA256 dcd11e79ed96f27646d7055ec6e35e9383c4dee743f58057a1f7b7d8eecbb95d
  • MD5 d357fc96879e0395cd1d8d1788394be4
  • SHA1 96026d1789b922821565587d598cbb8b6868504b
  • SHA512 da4151896cd62cb6d104dedf7f62bdd995347014659890c52cb41696452b8fc93c7a27d17edea402c56d1e93b257eda6bbe3ef8cad532870f2c0a72e8303aae4
  • SSDEEP 1536:i3PggRctAiS7NATDeLBTUb90P3oK6GwO4Gcvh:i3BOAxRATKlUbKNwO4GSh
  • TLSH
    T19B639E5C77E50921E6FFABB01CF23212CB38B6639D03C64F68D9058A3727698CE116E1
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  xwormrattrojanexecutionpersistence

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2