Extracted

Extracted

Extracted

• • Target

    PM-DETAILS-STQRT5RX-102024.pdf.txt

  • Size

    584KB

  • MD5

    5513c9002d741f622e82e61505c8255a

  • SHA1

    c3d1b2fe4e9d382e448261dc4fcbca1c17859a17

  • SHA256

    a7db6879ea9bb70d8d8d9c22e620fc69187d0fa226e7eb6f89ee6fc226433352

  • SHA512

    a61f6cda41cd38c904ef1c9ce2365a0c82b10673523db6d9bf2ab89ace088a6c80f859edf9e1136cd6929f050ace025650fba0e80eadaa4d281909f830a674dd

  • SSDEEP

    1536:7E+E+EBE0E3E0EjEDE0EdE0EBE0x0EgE9EdE+E+EBE0E3E0E0E0E0E0E0EBE0E0n:YFyN

  Score

  10^/10

  executionxwormdiscoverypersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2