Extracted

Extracted

• • Target
    Proforma. (1).js
  • Size 234KB
  • SHA256 c055d08caee62407abc90ec8fc41d4b59ecbf235f68acb34a25199c5cb622142
  • MD5 707b6544a45dc457c01555e1d0687f0f
  • SHA1 9dbd4ed42a3bc4366cd1a5ade8ea6622fc5dbbcb
  • SHA512 a79631c2d822936b8441d5aed2f364e875fcc61192b02a4cca02be2eda0d1184db9fccef262f5860b40144f1c97d23e326a477edab73855e7b205ccf6dc94f55
  • SSDEEP 6144:jUM7uTDOgwMbK2qt07VgFByn49RUzJ7zs:jU9vZweKxt07VuBy49RUF7A
  • TLSH
    T11F34BF997391722D854486E0446F2F9FB2D3D803A9DCC0A469FEEBCBB64BBF49534250
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslaxwormkeyloggerpersistenceprivilege_escalationratspywarestealertrojan

  • Detect Xworm Payload

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2