Extracted

• • Target
    XClient.exe
  • Size 30KB
  • SHA256 e6277877b5970a79b5f7e90ee9fd3dd2e93fa3e85223f58d1c15602d62de6385
  • MD5 825b09708797fc88fc4961326e3075e7
  • SHA1 1c868274da7f9691d064c7a72a3da6e297ac6350
  • SHA512 0464b7e63d275ffd543c847ffb2ae08dc74c41792ed09807022d29f1e6c51418d9e5152419a6f753bfaf1f4e2aa38dc84963cc15de79f23f1777e8beaa52cb43
  • SSDEEP 768:BJCIMRhP3VMYAoRN9M2uBFE9RDbOqhAbi:/Cv/f9M24FE9RfOquu
  • TLSH
    T1C9E24B487BE5432BD6FE2FF229B6910202759507D923EF5E4CD885AB6F67B8143003E6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryxwormpersistenceprivilege_escalationransomwarerattrojan

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2behavioral3behavioral4