Extracted

• • Target
    57afae31ea6c3113eac8ddfe9753c4536ceabf6c9a41f9a4f6a771fb4e2be4b9
  • Size 109KB
  • SHA256 57afae31ea6c3113eac8ddfe9753c4536ceabf6c9a41f9a4f6a771fb4e2be4b9
  • MD5 5ae50728012a9e55cbffc31d057a56c4
  • SHA1 4b4a6a7069c3c4718830de2b5e3658a1ffc18368
  • SHA512 3a29337249f1952826b4ad94bc52fbc2785e49bc6617ec5de9896e36ae35f969b1857ac5577c5f11bcf9e45815203622711424dd690d3098d883f65e13a820bd
  • SSDEEP 1536:W7oh3Zp1DDX5eiNhaiQsqh52TEG+uCoe3N5+zAOY/VoqYau7UfALKhFLQR0lM:Yohppbekh7qhAEi85+s//bjfy0FRlM
  • TLSH
    T109B312404E2C5C54CA01B73D7BFF17FA592D0878297F986A06B7AD82C39A066D361E93
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral1behavioral2
• • Target
    Contract - CB-KLS+А+В2 (003) - 05.08.26.js
  • Size 202KB
  • SHA256 32cc5ce6ca786875f7399fb4a39fb8fa778e8e5d519cfe9b8851428ad8f3bb3a
  • MD5 f0392b5ce0fe0b6acd8b1d02f5b4d494
  • SHA1 6c1680b6a8c33fd84ad1475f7f5e4b4e95868546
  • SHA512 52c20c65a37f43c15104fd743dc9031a86db01606b6c063b3a90e4f1f51300a7ba3aaf6d5813429f5e85d6a67d95a37c20e2ad7c0584bc7c03db65b5b1162d6b
  • SSDEEP 6144:pemXq5234WRXi0pb+aIbYy8IIkbUhDuE3Sm1sX:8tSy00aIbYy1RYlutX
  • TLSH
    T13914BF2C33B3C80CD1928B392D4F99D471E55244CC48C6746AE4DA6B7CF148FECEA66A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of SetThreadContext

  behavioral3behavioral4