Extracted

• • Target
    Ziraat BankasI.js
  • Size 340KB
  • SHA256 08158b0913049c81eafd1429882080a549d81477321e0209df14a00f2f213ad5
  • MD5 b7972c2d67975abf06c2078004034d51
  • SHA1 ebc36646951bc00a2f4358d9cbb624d2ca89a463
  • SHA512 1dcfa5379790f2e790f4768cb59500f7776f5dc8d2c3c2ef7536f0ad0f3e8b452880cbbbbbb9c46ddd4f2d70e208c8856b0dae5b8e7078db249586794838a4a4
  • SSDEEP 6144:37ptlaLtCJ7GN30bbv1n3ZIcs09VScOuyiQFWRa11OgskfgtoyHcUJcAsWj:31tm+GNy+cxD40QFWA1Oqg/HLJhsy
  • TLSH
    T13E74C0446FC579BAC706D43F3CBFE1B9F15A0D84A244C048FB26F8A8FDA5706D629264
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionxwormpersistencerattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Drops startup file

  • Executes dropped EXE

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2