Extracted

• • Target
    DHL STATEMENT OF ACCOUNT - 1003397420.js
  • Size 1.0MB
  • SHA256 5d1c18b3b20ccac91f62c0d1558ed5e4c841de0b39dfffa1e99bd38c952f61e9
  • MD5 a88b993586de2cbe007d939ad930f46c
  • SHA1 ed4c49ca6584adf11f0246269b79209c9fc36979
  • SHA512 c3191e41a2aeb0695ca81483e4cf3d66b34a0b45708e419659d5e3fb0422a56f4021fb74335546feb9bc7765fc6e370678c142ad32457bc022de1522fd5c214a
  • SSDEEP 192:XyGMrvxJ9+fx9vrxrxffxrhrNqxxTlx1rxxMfsv9rr9xLrvC+CNr9r9Gxr6orRri:lfP
  • TLSH
    T186353E9B72B2A6E970B502F3C80C611CBEC0261F7A656CFC7F6E8146654A53E1C54BBC
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executiondiscoveryxwormrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2