Extracted

• • Target
    Quote Q547690084.pdf.JS
  • Size 2.4MB
  • SHA256 1d62a76d0311297527849b772fcb42eb964d10bbb0eeced50d7b83a94a9e7ef7
  • MD5 776e0762bfe4b2d1ca9c980d4f3559ea
  • SHA1 197ecfa65dd949d76be19f35da2d0fb4a0bb6517
  • SHA512 f11a4cc7e1cbab70e3995d06355aeaff4311ecbd8e26a966281b85523884e9530bc40a6ef8c5821595cf787fee13f0abfca3da01d128418a46e7403d734c9ab9
  • SSDEEP 49152:xQwzTRGJwvQBr3Zq/JIJ5IoNvq1F+ULn7VbCOZmEt5ydK9KJMQCRV7hHMUZeLq1I:xlzTRGJ5Bo/JIJ5I4YLn7VboEidK9KJz
  • TLSH
    T181C5B3404306A7727AAC335DE13B9AA83915620355C8EF7D3C3C828477AD92F975CDEA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionxwormratspywarestealertrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2