Extracted

• • Target
    SOLICITUD DE COTIZACIÓN FORMAL.XLS.hta
  • Size 1.6MB
  • SHA256 f8393ec6bb72178d727ee6fa8d73fff62ba61268297a879f6df108c688b2fba8
  • MD5 2b076d741cb169cfcbe27857eddc6ce6
  • SHA1 93195efe73fa426391e7473bf7de7fb10382bf0a
  • SHA512 f8f38463a823b234544d3c25f065c83c2a295a051382afed545d3198ccee199d67d9ffceeb33aca30d52e85a1c942103b9281e73773e024e766ff6a24502001a
  • SSDEEP 768:/OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOk:1b2AU9
  • TLSH
    T1C7757C2963C96B0FD2971E314A032433BD75CC998E2DD5167B72B89CECC597B129183B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormpersistencerattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2