Extracted

• • Target
    Cotizacion.js
  • Size 301KB
  • SHA256 a02f741d30e33d72c6fdecf0ae1fafa2c44bfd40987a9480c2a11d8f5cd058d4
  • MD5 d7934855370a22c165563e3c96ab4f2f
  • SHA1 835f75426cd2a5e377286c84cf3ef6d3823095cc
  • SHA512 334e02746af710dbdb91abb8c559daf78490a3ad0aec41408c18dbb50f273907b1db23917f34391383a33721218c10988aae70c5b80717a40ee022e74c69b6b7
  • SSDEEP 3072:JJFImrWyyfwimdGWzFr8mxM6DMw0iuavFVZnhBqJm33jsGzy+zWsyBFcdHwQJYGK:rGzo0iuYCLGsJFOy
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  executionxwormpersistencerattrojan

  • Detect Xworm Payload

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution
  behavioral1behavioral2