Extracted

Extracted

• • Target

    CENDO RAMA JUDICIAL - Oficio 392 - OFICIO Y DETALLE DE ACTUACIÓN JUDICIAL.js

  • Size

    73KB

  • MD5

    ececcb43f7f2e1f294047fee6512849b

  • SHA1

    ab25ccd9dc155e90b1828ac77b4deacfff2bd98d

  • SHA256

    b03d8e95d48272334f35836a28a163f153eb3b00e97ce0466a3dce8202527f23

  • SHA512

    fb2cd31e8f258fcadef22ff71686e1f8417d157b9bd56f0e2ac0493e92b8d0be5a1435977a7dfbe1dd14ac145ac41e1f73d893515fea823f02a51387a0815f4d

  • SSDEEP

    1536:4l4izQ6VsYX/f53KKxAlFlwWJOKumLcAJ152k6:41zQ6Vj/BKpW

  Score

  10^/10

  executionxwormdiscoveryrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2