Extracted

• • Target
    XClient.exe
  • Size 43KB
  • SHA256 bfe17f67bc0a28de027263c731787f0cc5b992f1766fead4df1181bb9f65b265
  • MD5 0e26330a163a2b95621408a7c7650ef1
  • SHA1 4d6c621a869f3de023275ed6d8ef47d57e371bab
  • SHA512 07db9723ec6db30212172402d43cc6102c4384af96f1d47281209b29790a9a9ea483b3ad99d7e9ac78d2c02b969c09ddf72f90ba13693f8d1b3328a450a9ba7c
  • SSDEEP 768:TShSF/PZGyxwFLXdjK5xL5JFRPa9C1OChHOiIh+t:TESFRIMFA9C1OCZHIh+t
  • TLSH
    T158135B8C3BD44615C9FFABF919B2B2060631FA139813EB5E4CD49A9A1B377C54E0139B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bootkitdefense_evasiondiscoveryexecutionxwormpersistenceprivilege_escalationrattrojanadwareransomwarespyware

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  behavioral1behavioral2