Extracted

• • Target
    XWormClient.exe
  • Size 70KB
  • SHA256 5d61a25574a0750d45975826094c8d2d71489b538284a513772655b4e0546b6f
  • MD5 5379dfeb70df7e4bc188e80fa02889c2
  • SHA1 2fa38c23d5929ede7a43a3d3c25fd7728071c4d1
  • SHA512 ea66f1081950ec70d7d28b99c6c84a596a623a622b039b6ac49d9be0994d9e70c34e7d77b4e21e3f901befe3f7f027688f04904ea6be2b7fb723a114893a0c60
  • SSDEEP 1536:wS3SeT4sc4UdPmawmSV2bnybCc4a66D4RCMGO3AQoE:wS3SzsyamSV2bnLA4RZGO3AnE
  • TLSH
    T1A7637C5C7BF64126E1FFAFB159E53253C636F2636507D61F24C4028A1B23A88CD816F6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionxwormpersistencerattrojanadwareransomwarespyware

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2