Extracted

• • Target
    H98765456780KL.js
  • Size 317KB
  • SHA256 a6e4442a498556cb086f98024ebafb6c85719fcbee76b04e0e8889673fdc6024
  • MD5 915e9f5d9fdfc894140aeead4846670f
  • SHA1 967d1179fc36c21e7e04bf323738bc3d210d5939
  • SHA512 0951e579d8aa830245d091a493f96a233ad3b014148cf632d7ac1ae15c04ae8f7301359fbc623cbd456d7a98f1f8a0d16c0535c19d985367c89e0d7d84e60a44
  • SSDEEP 6144:xOvHFawqU9vlUkwuzkBEvQCiV8s5FAfaUORMs:QHFrt/v4LrU4Ms
  • TLSH
    T1E164B0846FC1BE68DB56B53B283FB196E2F90EC5928490CCF712BD49FB6170C9436624
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionxwormpersistencepyinstallerratspywarestealertrojanupxcollection

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2