Extracted

Extracted

• • Target
    SF-00092801-0182.js
  • Size 980KB
  • SHA256 14a6ae1bdc8e2989a1d22f0d866866abba4ef6a89075c66e0b5d38881516c7fe
  • MD5 a639958fd3a3265d77f346a95dab6530
  • SHA1 ef124f963fd58b95c6fd1f4784230f12f4209c67
  • SHA512 9883670f9b0d93fa4b402149549751d1d913242777d852234c6a9ea6109943fbf666c4c057ebaee9ea79e453326b19cae07b99f43782c5e113ca5ce46975f5cc
  • SSDEEP 1536:o+BCX4c0e9sgfCFJvMugkdwGHAqCUMaM9xFK5abFjTRDvhADYwD9mp8fND:8a
  • TLSH
    T12D252FA3F28F82DAD3018E1F7DBF4D4265ED5A4E06A972FAB81795FEE2244044D07934
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2