Extracted

• • Target
    XClient.exe
  • Size 34KB
  • SHA256 8c43b4698d7a90364ea8d27579f78651d35c86e7d1bfb86575209427b379f7a8
  • MD5 be94e32aa19d38d336abc64c0728b832
  • SHA1 2b8e9576845c904f8f7d88392b23eadbba6a24e8
  • SHA512 fa1c4005ad132d29fcef511ed0fc548d3621ba9ffa0ecf64279ba7fa5da52bc355429ef4d7f86d9306aeedb16fc1229974c951e2d50ec5ed836b4525287d087b
  • SSDEEP 384:UxaXVqG28uymzhzUuHnOmYxLm9cCwvHixdTogVR8pkFTBLTIZwYGDcvw9IkuiszD:saXUzPi9wcC4CnV9FZ9jC5OjhF/cz
  • TLSH
    T1B8F23B4877904322CAFE6FF16DF3A1090274F5079523E75E0CD48A9A6F279C28A507E6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bootkitdiscoveryexecutionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  behavioral1behavioral2