Extracted

• • Target
    Slip-02.js
  • Size 1.7MB
  • SHA256 095bc1f68b458fac05aae349543df9de3961749561fdd48d8f1914bff0f5db9e
  • MD5 72ad0d3b9c263c0aa8dcc26990f794e4
  • SHA1 8321ede87805bcfd70bfe651a41153a2c00e1c63
  • SHA512 52f169669e35855ac8ae4e8b50dbb33b26392f5e2db6022e4b6efb520af2f7e0f0df535e404cd46f8d7fd8aeffde8dd006ac624842968d95bf6adbdb8f4bdd0f
  • SSDEEP 768:hxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxD:3l
  • TLSH
    T1D6853B56F7DE0FAD47316F146E33980AB83A60F0492F842EE51BB094ED4E6B95385DB0
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2