Extracted

• • Target
    ORDEN DE COMPRA.js
  • Size 947KB
  • SHA256 ebb88aaf2b34d4a18ee48a53c34673008742408d4f37c82f798e53d5160a6959
  • MD5 06f8fa00d40da2ad3293e75bb7b95dc9
  • SHA1 9edb2976788945e8f69963e1bfb5ae1cf92325c3
  • SHA512 504b3ef0784af0021e47daabcbba00c7baee94dd7d118820abf9b8f55b51d18b30d05d4c1b68cf3eb090dded078fedf6db9a366b84be0244e6ed7f6abc210798
  • SSDEEP 192:yU1X4osItribJtJMOp56H/PkD5pid++PADwa8NZQQPH0X7Z14EaW:yUnsIJ0JtJMK56fPkDzid+5idv0JaW
  • TLSH
    T16A253EC1298247988F944C27DE4A6EAC8211093BDDA6363D3FB96CDC31C656FC625B73
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2