Extracted

Extracted

• • Target

    PORTAFOLIO DE TRANSACCIÓN REALIZADA A TERCEROS.js

  • Size

    164KB

  • MD5

    730bef083fbd8b608106a9c34c98cdc1

  • SHA1

    4c8d3440733b2975d1c9a823df735cd11a3351a7

  • SHA256

    37c427cb456a7fadc42fdcca721a2e24c7f6a43892870b6683bf4bf83ba4f52c

  • SHA512

    1a4638ccc02d2774377a114c99fa3bf1e2e6790ae6c4c3ef35dc4d7ee146e4201f51c765d49c2ee3ecff3cef7f79ccdd1937bf479c3380da9e6b8276384e477c

  • SSDEEP

    1536:OWa831+p9/3zJ7WkAZexE7EnhqOWxK4YEYL734izQ6VzYfA75CKPd6BBPWa4pmGu:OWr31O9rtWKXVueEG7LzQ6VYAln2

  Score

  10^/10

  executionxwormdiscoveryrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2