Extracted

Extracted

• • Target

    E988635D9E1159BC4C77C3C9838CA0492422FES319582900779615.js

  • Size

    163KB

  • MD5

    00a4ba139e436facb9861b2ac35024fb

  • SHA1

    16396955fcb4bdf72d8f67fe37ed6c17a39bb9c2

  • SHA256

    9ae6de36be82dd3f67dab2f0406030f65e72461702ae41e097d75925f4d468ec

  • SHA512

    8ff47d5fe6381c07947e56e82e235fc0e2f75992b94f842e716b045259ce6488a2b513748884416c79b0f90e2fd014f7959747d1b3b9e1fd0a23d58396f6ef6f

  • SSDEEP

    1536:xyyVPkspf9s3r8MHps2DxE7EhpdH54HeI7YUnt44KnayzQ6VSYMLR5vUVtOvivcM:kyJksp9YVHVRutCzQ6V6L7uHGi

  Score

  10^/10

  executionxwormdiscoveryrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2