Extracted

Extracted

• • Target
    Machinery products.js
  • Size 1.3MB
  • SHA256 37166a166f46785aab88ce7218154a550aef78fee57db838ee5600bce3db9db2
  • MD5 b7254bd3c19e7937ea8b95d064ad722b
  • SHA1 61e620764942d8507f0f089b73695ac89ac9f6d0
  • SHA512 9f909d584c5462d8aa05c48157402cdadb31d36c815b1ef311e4992ab11d53c55d34d04c766d267ba7b004521276f0488c415e902e11b4a9203a326f7954c4b8
  • SSDEEP 384:uwq4Nymg13/lufpbhiLvhD7vhDorhL/b9bCvhD8Ve2wVUatBa9oXwM65hCtSu0CQ:ETpD9bbq
  • TLSH
    T17A55050376D0049DB39E32A4846876198C63D53871DAB44979FFB6CFE5046EC28BEDB8
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormpersistencerattrojan

  • Detect Xworm Payload

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Drops startup file

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2