Extracted

• • Target
    Order specification and Drawings_Pakgreen_JPEG File.js
  • Size 1.3MB
  • SHA256 43c8dfe3daa3b5402f2c673b1bae02dc73f653570033efcd63e19a9b0f3e0255
  • MD5 0b51df3b56a9d440d4671a3b6cb2bf18
  • SHA1 3b4eff84678493328d488a73e733964a05333438
  • SHA512 74d3ca0fc401ebae7bd4c9fdb5606c5e89d788846061d58e3e90e5f4edfb4f0d9fc57b7eea01e5542a1e6747fd748fce586356aaaf5ad2c09dbf79fee7d96162
  • SSDEEP 1536:8vUXW4x1be+R+PbRnespjs6QzBMUaLIQchx5o8N:d1bBRsb4LgLIQYxb
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  executionxwormpersistencerattrojan

  • Detect Xworm Payload

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution
  behavioral1behavioral2