Extracted

• • Target
    DHL_Shipment_Documents_AWB1370659_ME8933092.js
  • Size 2.4MB
  • SHA256 40612b9531e0c9aba67bcb342c89933474eb886e5fcb09f202202edc62969c75
  • MD5 98f2a55d8c14ffb4466fe2c1824ed79d
  • SHA1 0f53db21e5cc6a4bc7b3c3ac2b17e09578a90ab7
  • SHA512 a612277ee5491899c9fc9a042019df3b84221d473dbd050231611ce4169d585a5050d66cc5e5edff07ced9b515cfc996864101b29c228cbaa88ea47716d5d655
  • SSDEEP 192:igdzJOEaj4QReTFOLCFwtIpXt0Pnt01EXVvvFcgFfv:Zd5CtINt0ft0e9v
  • TLSH
    T125C57B5CD2E68398FB013874ED147504FF687F2F459849B837E027C84A364A95A1BAFB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Drops startup file

  • Suspicious use of SetThreadContext

  behavioral1behavioral2