Extracted

• • Target
    XClient.exe
  • Size 200KB
  • SHA256 2b316fe1a716614f4934e661f2f3ee9614d049a15a534c5e3354e28deb99f5fa
  • MD5 ac0d5dcbc6e6c3a3b52fdebbdcd4a75d
  • SHA1 92df40caea8263071761007a358a96340c2f83f4
  • SHA512 1fcc15e575e8b01cf572639b4a6960b1fe12b058c5164aac8ae95e62b7bd62abdeeae1f6140fead7929c164fccfe24fd18d846e0871119babe769bffa1b6ec93
  • SSDEEP 3072:jF7ilWyFk9wNO/3b8SKfbzxcwg7es6/Vsb8VKTup49oJMfF/H9N3Ky9NzLnK:hkk9xbUhcX7elbKTuq9bfF/H9d9n
  • TLSH
    T19514BE5C3F518D42E9DD4EB504B3E36CD27C9D636E0D9502DA987EA82B37E841E22363
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2