Extracted

• • Target
    complaint to the cour 200826.js
  • Size 233KB
  • SHA256 73d3fc27bb8991f739e2d52007e5a466e24682e0595fc7b12c5e0fec6457827e
  • MD5 ccc1d8afd1db2743661e1b62ae560bc8
  • SHA1 8113af718c36d98082f54cf59aebfefe3542979f
  • SHA512 5a9eef09921938f87d69d83916e5de19e797f34f5a1cb77885c0fa272701005dcdf5c6180e0b553fc2dad484e5c3ac4236df1d9bbc94abad37e2bc73c4d8e52d
  • SSDEEP 6144:lsyB19J1v3gM1cbITMgG079Btd2xUlSd3tIBJYMfHg2/Ge:lrBLKa21jIBJYMfHg2/Ge
  • TLSH
    T170349E6C0355062DDB6950FC152F174B7CE5EC81A8A88390BFFACAE3772640589F4BB6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2