Extracted

• • Target
    Comprobante de pago.js
  • Size 1.9MB
  • SHA256 7a0a306f43306dacf6e870c719140df23cf795585297ec04a1308f8f8736da1b
  • MD5 0e197e5952316897d03a9b56f8a192d4
  • SHA1 9fe4fe2feccfee9128bc9605fbed1a5179fce91f
  • SHA512 67eaba0d5ed8693930bb891700a3096f0cbbe35f501c7ebae6db08de748d2f2a9a3b911113d2e0ceefb5a03359528c14c1e62314caa5c3ab53f90460b2fddb2e
  • SSDEEP 96:0BSBSBSBSBSBSBSBSBSBSBSBSBSBSBSBSBSBSBSBSBSBSBSBSBSBSBSBSBSBSBSc:7IkSFWwC8F8hgsVqkrarH
  • TLSH
    T1D5957B1A0FF498D98B1ED32A9E6B0C7192158173473BFB6D27EDB3942910D12B2E4D63
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionxwormrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Drops startup file

  • Executes dropped EXE

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2