Extracted

• • Target
    BO_x_07-07-26.js
  • Size 163KB
  • SHA256 f3db3ac8ed48e43372d8fe7988a43b33b859dc324c882e1c74f0e070a7a82a13
  • MD5 cf66373cb512ad74abede5f0eb657c29
  • SHA1 dbd12fc943fa53d0ff2e68864782f56808db0ab9
  • SHA512 023313974f70245504c673a2313e6faeebc4efe841c4659fc40a41c2e07215c076c7244fe5331d64ebfeff94fb5eeb7d43752d898f8fd2152d5ea8223372803d
  • SSDEEP 1536:e6yt0FrZXQuuFzDCaYnV9w0HO0tN41UKA/cistt5VvkePAWtlH7MVGxGqIfH4tI9:HjPXQrQJkabPzDk4I+jeW2hmajz2ns0
  • TLSH
    T124F3324C26D0EC9C43E75BFAB62FF0D5F49A4CDB69488C46A214F850F4A460BEDD2A34
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormpersistencerattrojanadwarespyware

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2