Extracted

• • Target
    XClient.exe
  • Size 36KB
  • SHA256 f3ebc22335f3deb8893c76206dd93de9625717a311b4db137909e73a117e3927
  • MD5 6ab8f373e662fe25f8df79d1e1c63802
  • SHA1 02a7a4052aecb7a7fd1cc9396541a78f5656865a
  • SHA512 933711714dcc0758b9fc3afd29662413ca413343889ab36d855bf4ba205c76717d0a2c4cd9374bb7f37e27af53efad1e9f13bbf2e9a93baa3b5dec14db6e2838
  • SSDEEP 768:fkhqT1dEvf6nQWrAer3sjbHLK+z35FWPO97Xx63OMh698Ou:I+EvinD38LvFV97Xx63OMwy
  • TLSH
    T1D2F25B447FD48236D5FE2BF929B292014274E70B9A23DB4E18D8899B6F67B844A013D6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2behavioral3behavioral4