Extracted

• • Target
    MB320843298AE.js
  • Size 207KB
  • SHA256 07f832fec18520e00fd3366300677edebd045585873aee8c19c6a51148854429
  • MD5 fc35e7bac1d5fc7589b364648f1fe267
  • SHA1 6cdd8e75079a8ec759c1089687c39222f4c2fc11
  • SHA512 7d4056e5374c8cc305fb7d7690e4b50aa807338689de0cde486aa017261238789e4511b5c8770cc4aee4465b1fedd5252039cf84d9a6300a0ae5950a57b03c88
  • SSDEEP 3072:8tVTtcMFxf7Ax5gJdtrsDbascKT5RylDBjqscB/i+TpMyApXrLrziI5+qxyhjApg:4TuuxjAAJsjc2cloBH
  • TLSH
    T13F248E6102B37E7CFB5426B9047F2AAB61F8FF012810F15BEAB27D475D25CA1C542A9C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2