Extracted

• • Target
    pago.lha
  • Size 2KB
  • SHA256 49590b19c882955eef7af8890ab975ca2caa5285b4f504dfc9bd566d270d37ab
  • MD5 dea69408ea474979a0e25be126af9b24
  • SHA1 6a207008c394277c4302b2200f914c5b0e02274e
  • SHA512 5dd38150769e5f483f895f3e3734fa7bae4d1e672b5757e331ec512a66e1addbf1de9ecd9763cc6f05a0dca1f03a5aa7de273f05ed0d352fbff2044cf6ade697
  • TLSH
    T18B51E768F62998D2D43F67B1AB87C91A8E643A4F7A74520EB95361400909E9228B186B
  • MD5 SHA1 SHA512 TLSH

  Score

  1^/10
  behavioral1behavioral2
• • Target
    pago.js
  • Size 2.3MB
  • SHA256 21327e4b5d555b1adfdea28de614bfd2d3bbbe05bfd849ff2e6019c70e09d117
  • MD5 19a58a6944ada3c05a3e439390b75119
  • SHA1 f3b099a78566d464c9fec9ee048f57d29345d15b
  • SHA512 055644d02d5a651daadc4b4b1cb60fcc9e241b22f562e516a96b2d308ab72c5e7de1e054a2737f40d0c6972f32ea48dbf12b881f3a5e51a4f48853886bdae108
  • SSDEEP 96:3cKcKcKcKcKcKcKcKcKcKcKcKcKcKcKcKcKcKcKcKcKcKcKcKcKcKcKcKcKcKcKe:r8mxlqjT0rNAVGfBYGuV
  • TLSH
    T1FEB51277B6E60126D1AED7EA24CD9D72C51C80CC36640E8A256FAAE2D32E745CCC74F4
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormpersistencerattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Suspicious use of SetThreadContext

  behavioral3behavioral4