Extracted

• • Target
    XClient.exe
  • Size 30KB
  • SHA256 427a4cc7d184449eb70a2c75462b3a142ab718b9d4d22d3f94b8c5923c164b35
  • MD5 0a79de74fa4bda262e7d74b8aca27984
  • SHA1 bbb6b4163511f81961a499bb1fe44d5575cbcb1b
  • SHA512 607887e4b1953fc28b68fa2b7acf79bddb33ca0893c3c08f3a87a9308b1fb74a6a68e4964e290055f228977393fad308e801a0c1ba9374300e31ea3f4bf3686b
  • SSDEEP 768:yHZrtxekwo1YETDNAsbBFR9Rl9OqhCb4:WZr6AAsFFR9Rl9OqAc
  • TLSH
    T1FBD24C0877E58327C6EF2FF229B291010375D907D923EF5E4CD885A76F67A8142003EA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bootkitdefense_evasiondiscoveryxwormpersistencerattrojanexecution

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Disables Task Manager via registry modification

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Drops file in System32 directory

  behavioral1behavioral2