Extracted

• • Target

    17112024_0044_twBkX.js

  • Size

    199KB

  • MD5

    4ceb1057e744898bc02ffe2a9daa061a

  • SHA1

    ccc89e9d665bc204347fbc7346957ed65ef983ba

  • SHA256

    d2c8b31ed90c86ec267b673178ce22b36096ff8d705cbf9b5fa8ed4bac87550b

  • SHA512

    3a71dba04527b03bb0ee1384f92b33eaa3de7bb3f1521997fd3151ef9ce553bfb5608054919b37c35f0f6f611acf59805949e586e52e3ca2cfc85e57f246c87a

  • SSDEEP

    6144:PsnbkwFgwHtYdNCI8UpzdKxJzyU+JnkdTm6YDwDB:jNCzxpDB

  Score

  10^/10

  executionxwormdiscoveryrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Suspicious use of SetThreadContext

  behavioral1behavioral2