Extracted

• • Target

    DSDDDD.exe

  • Size

    69KB

  • MD5

    fa699362343846cc0cef79e11c156718

  • SHA1

    9dc34285424c208a76d7324d76f1643c398d10f5

  • SHA256

    ca847cd0a27fd89fc04c1a7972b9d1dcfcf9e9a7be35b21c2d36b4c9f0195bea

  • SHA512

    56355dfa64fab11bb8d39a73a81217672cbb7a3b408897bdade6b6438ca556ff20f8e0147dcda8d408ddd6c636335d995b2ff129134766eb62ba29c947f242ae

  • SSDEEP

    1536:ML9bRckOzKJXx/FG+Lg+i7Rjazb5C3ECm6ME+dOcGdFfgIl:k/cextGeSjazb5ohUtdOhpVl

  Score

  10^/10

  xwormexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Drops startup file

  • Adds Run key to start application

    persistence
  behavioral1behavioral2