Extracted

• • Target
    Drawings & BOQ Document.JS
  • Size 2.6MB
  • SHA256 273d7bda9c55f7c91141f3ac1819f6d8cc03fdff1458d4cc44544e16c8a56fd4
  • MD5 5a20de01e58dd91d34fdf737d1f36528
  • SHA1 f2fe51de9cd8334ec91a187e4bae36d8c4682247
  • SHA512 9661ebfd7087165c7ef6149239510dba2c75ff349c42bf6fb11063a0d9009aec0afac518890fef840904f66dd1800b8e7597b585145db25e26aab15a36577398
  • SSDEEP 49152:jF/d462UL0LbpOjj8JFNZRNkQqi0aB4H4SAW8QyGlGz4PcpKU8cQw:jpd46vL2bMjj8JFNZAf0B4H4SPmGq+ox
  • TLSH
    T1A0C53A14872462B2692CD37DC036AF6C544D600B68AEDF0D3D6F4624791AF9B934EBE3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormrattrojancollectionspywarestealer

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2