Extracted

• • Target
    КОНТРАКТ 39253.js
  • Size 963KB
  • SHA256 df4e3e6182bb1d5163fbcbfec6426936513d8f2cdb284d7791e09a379cc63edd
  • MD5 ced4b1bfef532ae68a55235a997769ec
  • SHA1 de1fcb31e139bd11420de0c83438a7d95ab0d2d4
  • SHA512 2b7d3f51e76dbfaf33790a4f46e1da738d692ca17f8226987d9574da471a013678eac8e77762cd91c1f66f26df3fc3ddf056a27b148cd6e6e9fe9fabdf2c8072
  • SSDEEP 768:CSLLLB/VEDGoyW+IDfRPSSLrzLTLz8Z7k2hLnKeGMyLegc8yy7zzL/LeL/OL6EDb:uLvCvbdoF
  • TLSH
    T1222530638F4B8248C3F28D28CB2181FBD260948D2B2219FD74D9BDED65F9521ADD4637
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasiondiscoveryexecutionxwormpersistenceprivilege_escalationratspywarestealertrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • System Binary Proxy Execution: Regsvcs/Regasm

    Abuse Regasm to proxy execution of malicious code.

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2