Extracted

• • Target
    Payment Swift Code.js
  • Size 2.3MB
  • SHA256 ab79a10c8a0abace90b588c34a856ec66bfa403f55fb154e21251f4faee8b6b6
  • MD5 437da431fd1bb76316088b914a2f4d0a
  • SHA1 6185f9f1bbac5a86086b2f9863c65883bdad7964
  • SHA512 a12a7a864ee3e1ffe7dd77044c15d2c334ba4e90cfd7ee65f45edf5b1d804a1d1729b1e917352c59ed8d63f868ef97a235d97660209db7ba5cde61ef75358ad3
  • SSDEEP 768:fccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccW:ai7s/7Wj1CQBnK
  • TLSH
    T169B53B5923D54EEEA1B07BEA7E34AC05D678A47C4A2B61493B177AE0DC67CF04310CE9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2