Extracted

Extracted

• • Target
    PURCHASE-01.js
  • Size 995KB
  • SHA256 0da02f091c865f8c8577f9e6baa82dd9126ade41c7eef3968571fad1971a8ae1
  • MD5 1240b52f43089fcb0c5de3f95d52d04c
  • SHA1 bad58e1bea081c16470519419ffc6cb901551279
  • SHA512 c4afb722aa01cef8b9b6ad6ef67462cf837a4fc2c07736207a50e3da21500eec3a297dd21ae1d6bda044f1d7217b41dd5a9fb91ed85cdae7d5e6f0b677df943d
  • SSDEEP 6144:n/Td6rtMrJZlr1gtr0urjrrrAvvHhhxOdw3ELdyJMunrgyTwChZgEIu/H5rpLdm/:4
  • TLSH
    T1CE25A4D7D7E20084F69E0FA6C8B7E05397DA040E57632A9D75DEA9D0319782C8336EB1
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionxwormpersistenceprivilege_escalationpyinstallerratspywarestealertrojanupx

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2