Extracted

• • Target
    XWormClient.exe
  • Size 45KB
  • SHA256 5f743372812ae151a636b8b848a2a3eea3d8f137a577acce787a1077bba1e4aa
  • MD5 daa7cd1b2323c81db6a12989047fd500
  • SHA1 856e5ece33d58976b96ae81dc1facfe2d5013a1b
  • SHA512 342ec127610e2090133627bdcf79d533c9829c6fe15c4357598de72210d7663b8f6e9ebeb0e8123c808cfca3355cb5b3490cc9cef390ab9b6c3f941a9b610921
  • SSDEEP 768:GuanRhczEo9VdFZf9QV6pO1hLhx2OIm0B0oTV38:lanRhcoaF99QV6pO1nx2Xm
  • TLSH
    T1A7237D08B7E18216D5FE5FB465B3714606B4E603AA13EBAF8CE4859B1F53AC4CC413E6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionxwormrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2