Extracted

• • Target

    8fa2ab71f2e7c4276167c217778c01dedf71053bf9d4cee5274e8c077ef327dd.js

  • Size

    1.4MB

  • MD5

    3094dc3bf3dacc07b7ae62e6cb53e02d

  • SHA1

    7ff5441adf6b751704534c979046d5698dfdfdb1

  • SHA256

    8fa2ab71f2e7c4276167c217778c01dedf71053bf9d4cee5274e8c077ef327dd

  • SHA512

    48ba866defc3f817f8f043908eba4d8eec59d4f9af82c16184c95040c5d099c199999365f86d39619bd1c90e19d4a35f9f0b7292ff50ab1e69f161f363c46aab

  • SSDEEP

    1536:u3BYP+9LHqamUMgVSnD5MOUbsNZoxOhjPFi/nZky:aM+9jDWgVSnD5QQNZDhjdi/1

  Score

  10^/10

  xwormdiscoveryexecutionpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2