Extracted

Extracted

• • Target
    Factura.js
  • Size 1.0MB
  • SHA256 fa4d54b4720966445e20a0aeaf1761ea039089ada1b4f4fb3877a51cb6904ac8
  • MD5 a5b4c01041c8505597fc337b63c0fbf5
  • SHA1 95d8c71294728e8117558c5e690582eb617ca2fa
  • SHA512 4a19c9263641faecaa862210ba08ef70df65f8a5586a0de9dda0ffbe9efb5776c0b4b401d2ec91f6ca76961cd755261b3e0d7811598703b312d8a849ce0c118d
  • SSDEEP 768:Sip3I6TLVzNvAWqNAPepKRfCIVVVulrbnQbVbvVOIVLVYVb5NwuqTcah0jp5p5f7:Y
  • TLSH
    T12335BC79DFE80A5DB858041CED00B2B86B736B271AD9264C6994D1C94421BFC19BBFF3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Accesses Microsoft Outlook profiles

    collection

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2