Extracted

Extracted

• • Target
    Comprobante de pago.js
  • Size 1.1MB
  • SHA256 0e7b408f49d6eae2409b0de9a4a8881c8e9537acf1ef6b00f14c3da06ad1c49c
  • MD5 4e33fc5727a687d4faddbfd50fd7e191
  • SHA1 d8adf4058695d95c116e7d21a2f06095d01850c4
  • SHA512 f1c768fff85fee502d99206499d03ab421ac5ad35c675be2f14caef091bd6227f899806090c9cd63c33c58a6a2f80e4c3fbce2ddccb0f5fa5912a14b8a859351
  • SSDEEP 96:CRFVpX53rjvHRFp1hhJp15hpDPRR9nDHrHnLdzZdHfvXhlJJT9plXrFLFlPZH7pv:Z9090zNlMwQoTqwtJ7J0jV
  • TLSH
    T157459EF25B03A14519BB62FFB700838A11F457526192086CF9CFE68EB2B367A136754F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2