Extracted

• • Target
    Machines and Equipments Spare Part List.JS
  • Size 3.1MB
  • SHA256 7c69f6668cf71871bf34e53ba7c8cb2427123c7f6cf369957acf6021b271fc04
  • MD5 888d21c2e9ae69aa311d7ddfcc8a0b0c
  • SHA1 ac88d720f06ee63a602b009ab694de03fe1de0cb
  • SHA512 b843f38c7a8885e954af55ac9ef6f966174e4ff651810ad339c44a78ee161c18e959a72d4a84cee70a82bb44b2c29e9a0d3f777a3c5cd2e9ae4d86c7f5014b38
  • SSDEEP 98304:v78Kuh8y800IxvZzVhRd61isTSEOr+Y9pFiA:4KE8y800IxvZzo5WEOtjgA
  • TLSH
    T162E5D7D3426889BA767C930DDE7BE620036923039049EF4E3629056C7656E4BF35CBDB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionxwormratspywarestealertrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2