Extracted

• • Target
    Description of items.js
  • Size 2.5MB
  • SHA256 d0de0414d9280bef630943a834b38273798b1ab213a4ce126f3c744a8f343318
  • MD5 dcaa9812aa894087e1b8f661cd125912
  • SHA1 bf057bea57129571dcf2b7f6016e8408c9ce78be
  • SHA512 73239791a1f57140b1d13d34168e0cfbda0a5a8951a291f5d638741f513b37e8c0e9d4e636a4df5a85b344d5d2997de52a8dd6db993806d06d8d66508ab49bc2
  • SSDEEP 384:3llllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllH:6FeS16
  • TLSH
    T1E4C50177500D81EF9B3632B64E79017BCB4E071ED2C112AFA7A0F18973A2D09946DDB9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Drops startup file

  • Suspicious use of SetThreadContext

  behavioral1behavioral2