Extracted

Extracted

• • Target
    Orden de Compra _QO9944466788.js
  • Size 1010KB
  • SHA256 879a3af29eeff37e758ba499a10f5693227fd9a0a215e7a1b2f192f8d5fbe840
  • MD5 751aa6826fb62eda1f24206cbe76f785
  • SHA1 48c111e549ac17c3d62af63a500c19c0762be649
  • SHA512 fcd0072fc30de2552ddb7a6af9880219e5c0ccc1e6d1643c5b2dc11c3f911e1c17dced79a3f6a66e6806cf6f61b41cebb959230ae5662687bf860edcfc66f1ce
  • SSDEEP 96:DsxVJ/V1FJoJJiVFJ4rViJJTHnrd6/QVJblYATiKroJrxVw1V2XZQITJXVeJsXv1:rMzIX2+X26u7vNm
  • TLSH
    T127250DF2774B6A0DB1947706DFBAABFED742DD25B85446FF360AC2778850B018801E68
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionpersistenceprivilege_escalationdiscoveryxwormrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2