Extracted

• • Target
    PO1007563.js
  • Size 2.0MB
  • SHA256 a2be0c572f5595208c6359fecab1f2236a88a6730546e6df3e92cebbb10036b3
  • MD5 31f93a190e3fddf906b4384f8a80eb05
  • SHA1 bad0f4e33b8ccbf30ea0cad168bcd7b3158a3020
  • SHA512 69963171120004a30c27884a70c0dd888517b9537a26077d66e66f1151ea6c07daddb04c0a0ec80505e800b0f5501f448ac143562cab53fd08d6a258879ef7c5
  • SSDEEP 192:lwdwdwdwdwdwdwdwdwdwdwdwdwdwdwdwdwdwdwdwdwdwdwdwdwdwdwdwdwdwdwdf:BeMB+MFCltfxWY
  • TLSH
    T195A512A631AD0970763142E19EFED696E131080EDE233C5E74390FD62B71721EBD6E62
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormrattrojanadwaredefense_evasionpersistencepyinstallerransomwarespywarestealerupx

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2