Extracted

• • Target
    02-Payment.js
  • Size 66KB
  • SHA256 717367b26afe81de1a41fe61ca58434b7334efa2e83bc11d40f2ec319da6c992
  • MD5 0e7ff6caeb3cceb5be20e69a4850d45f
  • SHA1 119b81b4843edf3557a05a51608933c213f1acf5
  • SHA512 acac5069222b4d232ab78acf453edaf12a7fb88869513a9eee856a1a7d79a5c1f046db399f42dadd299193126693944a18a3b0eb831636a2f0dc0d55723ca387
  • SSDEEP 1536:mLvLX51LyLso6k4f2cCK01eDQIQ/hBuHWLBLrR6g:L6A9
  • TLSH
    T1A463999B77FC905B6EB66635E410040C86E402D7A8337FA526703CC13DB7F62BA29D96
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Suspicious use of SetThreadContext

  behavioral1behavioral2