Extracted

• • Target
    confirmación de pago.js
  • Size 35.5MB
  • SHA256 b66e79437c28bbb58348435e2dae72f72bf4c2d55ca32547fb4d37416a3ac0a2
  • MD5 c98a69e01df32539cb2d60bdf8181e45
  • SHA1 9db22201f293222bf948886815f8dd4a47bf0892
  • SHA512 06af1a9113c04bcb93a94ea7dde39b8fc15a427a3e3706773fe35c3e4880565b1fbb9bf26539518d16baaa72239b30a4552c9f7ac8f8aecfce671b8a48901e3d
  • SSDEEP 96:JMP2Ha6qqOqqqqWqqqq88NqqJkqqqqqqqqq6qqqqqqqqqqqqqqqqqqqqqqqqqqqg:JeoNqQePMBLb5VBMczT5WVhRmrt85m6
  • TLSH
    T1AE875E9D98584E56437C2A984A6769CEEE7FDC746AD8DB870D4FD09F08095B820FB330
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2