Extracted

• • Target
    Contract - CB-KLS+А+В2 (003) - 14.08.26.js
  • Size 199KB
  • SHA256 6ecdce814b4e49ffb10d7b221b75bfb0838aabe7f0f9a3890d3b4aecc4f23dab
  • MD5 f5dc6d992e73101e24432f95ac98cec8
  • SHA1 d38f5846440357a8c2b4fd1bec1bcf828ec02c79
  • SHA512 d71fca0ffe70f9d696679b7a3a855cb117eb1750e615ad5736f360803e2bf51de0332f47c6b6ff078da740a2b4cf50ad8428d8e0884b4c31a27e6c72332b3c27
  • SSDEEP 3072:FQgQmpbrRBHv8wmzyKQR+V2Ei518hL3B1uetCL0F4iJDCyQZv5OuCqE+bELs/2q/:FjL1rRBPCzkolyI+eqMI
  • TLSH
    T14C147C78DA85342DF10509AD500F27FC2FF194445805BAA0EFB9DBE3A839DC2B5F19A9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2