Extracted

• • Target
    XClient.exe
  • Size 180KB
  • SHA256 0f718358318b1b07114584ce2ae06230ad5d79ba15be9daf7350b51e5250bfb8
  • MD5 4ac764ab18cc3569bea4c1276c56570e
  • SHA1 810b1f3f08e06a05a92d90cb39705d4944a482c6
  • SHA512 803248253ce2fe57278dd267b5724608f0a415a711691ec959c33e735850bfe962cb4ac3a78b82f6559bc895902a5342c07f99e15cfb6eec547c7c6944c95441
  • SSDEEP 1536:s8ayt9Pov4YCB4mnvyx2SusOoxU3bG++ObX6oBCUOi66MEq:EytBu4nvysWebGq3Oi6zEq
  • TLSH
    T1B504E3CB2E9546B7D7ADFA7018B3733D432BA93E6BC39E0EA48B3D49173254C8940195
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2