Extracted

• • Target
    XClient.exe
  • Size 152KB
  • SHA256 40c89bab791adfdbe5f9b8d8ccff17ac7683158c8535effeaa9a2c87416a7b5b
  • MD5 72d8cd876c7f3a1c6ffe2f8e93a92251
  • SHA1 c4772d6093eef697e93a0b502547eeedfbd15be9
  • SHA512 33c98491766e5d46299c662a7a8d0c7af8111076444069df188d19912cabec22a0bcb9ebad304bbe701ebf36c242ead0f8ff596b4367f484540100bde8bfc1da
  • SSDEEP 3072:kmjh9Fv9bXOwu4NpVq8BxFRzaqF+o2GQJ7/JzqVfGvM:5hDv9sgVqwlL
  • TLSH
    T197E3B4698EEBB242C45A55747973A3824A3D5F79A4CF75158EE33FEE0BB3C9410130A2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionxwormpersistenceprivilege_escalationrattrojan

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1