Extracted

• • Target
    AWEDDC.js
  • Size 2.0MB
  • SHA256 3a0c6054dd092b1f1158f7fb5fe3c3070c94a87c89c45bc949885453d5e9916a
  • MD5 9e8f30efdcb1e7484e26b2df19a5a71d
  • SHA1 ffb108242338424825b1ef6d8f4c620ba1159194
  • SHA512 d2de495f0b0a377cd6197fc52f0519130e2910196d5b02151b5cc29c29b8ce0fdc520eff704d8b8e170b3c9404842fd6af0ab91122d443778b79d731908eca46
  • SSDEEP 384:acccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc9:s+bOi6D
  • TLSH
    T12EA579FFD56329626041BCB7BEB039838BC67B09B5A0E450A9D986436653F47DD80BF0
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasiondiscoveryexecutionxwormpersistencepyinstallerratspywarestealertrojanupx

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Powershell Invoke Web Request.

    execution

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1