Extracted

• • Target
    RFQ# 06142026-SCAN.JS.js
  • Size 2.7MB
  • SHA256 8be9560f26392b4e905203d1464ab7e6bb17c0091b3a346fa443867b6b9d8e41
  • MD5 9841107c46040dfd798d57a5f0de7eee
  • SHA1 4938e95378be04d9de42c9ebcfa0a82767cf4570
  • SHA512 6f66d927aa0bacbc1294073b24368f0126bd93b48660deb219ff7c93ab6521925d63d2c37a599c8493be70bcc754da8c9c500cf881d71d1f09c4462b52e3d234
  • SSDEEP 49152:XvojGBXXHQAOjiFh+RdYV8Ml94+se7NGGXTSNqI9/kzzTB1wTEtjgJ2g:XvojGBXXHQAOOHSdoll9a8NHeqI9szz6
  • TLSH
    T118D571300314D531E26C5B6DE5757A28140D198B94FAFB0D3AAA47B42276D3393BEBF2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionxwormpersistenceratspywarestealertrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2