Extracted

• • Target
    Comprobante de pago.js
  • Size 786KB
  • SHA256 12e766c1eeb336981f717f79f7af9162fc0785c2d74b47fd94db41e231b8eb1d
  • MD5 e4b33e5420fec238429f23748f33bfde
  • SHA1 8a2da4d9e0f2e38c2ce8f57a3619a2cde9666819
  • SHA512 7275ce585e359a853baf43f62573a0518e9bb2dfba2ee0a6eb30287e227b57543c8bb2bf1355d1e688d281b68688900d44449f8d662ac26bf83c6d7aa4dbee5a
  • SSDEEP 96:hiwKBARAz6+6zR6OwG6cJG6xq45ZKQ68AUK6aMf65y6bHo3sZ6zw39EvwY1P6Mem:CYzaCGGZ6eoOj8PGWVaQA
  • TLSH
    T1B2054F378FD3440CC269B0949FE5BEE162777E2B15174FAC391F68A8136045B988BE63
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2