Extracted

• • Target
    XClient.exe
  • Size 30KB
  • SHA256 1a5c3e7ee2b9577f64e6f8230872945814dc4eba01b11d175909c37fabe931ca
  • MD5 f28bb69b24449ef3c7c56417397fbcdf
  • SHA1 2e4ad7b6ba6dcaa3b4e8f50e8dc2c7347b767bf3
  • SHA512 03d69b13c7dd8abbc404298cc31f9bd3f23d890394488468f33c102159182efa3ecf0edfcc02bde5cd6250814d8b3e2fb64c443a726071a1a16f0a47612338ec
  • SSDEEP 384:B7wTA+5OfhxeelKn4MPLZhspJCXlYECwaipXQs5RugtFuBLTIOZw/WVwvn9IkVuK:BFx7s4EQw1YETDpAs5BFR9R2LOqhGbz
  • TLSH
    T1E4D24B087BE58327D9EF1FF22DB291020275D917D923DF5E4CD896AB6B67A8043013E6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  xwormrattrojanbootkitdefense_evasiondiscoverypersistence

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Looks for VirtualBox Guest Additions in registry

    defense_evasion

  • Looks for VMWare Tools registry key

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  behavioral1behavioral2behavioral3