Extracted

• • Target
    Quotation Request – Purchase Order Interlock Company PLC..js
  • Size 2.4MB
  • SHA256 1f0a9cf8d7c8376833f77d9d10b51d303fb96dce9f44183e0c1b8ba02f268a5b
  • MD5 15da1153897a83fb8009813f25c5de9e
  • SHA1 a8c80479846c1f6546834e0652feeb7267e56f76
  • SHA512 26b2344558f3fd65c69203004b44b0253560250730026d89ab03817d4b30bafffd6102b86434ea1af567315cf698febf07b93ef9da28b7b45c4a93c23d65fe20
  • SSDEEP 768:6aRaRaRaRaRaRaRaRaRaRaRaRaRaRaRaRaRaRaRaRaRaRaRaRaRaRaRaRaRaRaRx:1wR+
  • TLSH
    T187C5227477B34998C54BFCE69984F648EC4B97617F00494AB14B10D68103EABA7F2FE2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormpersistencerattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2