Extracted

Extracted

• • Target
    Cotización del pedido.js
  • Size 606KB
  • SHA256 60dbd4e01405d3696e0583015d8a1e1886f701198a818fdff043f055fab088a9
  • MD5 b61de385010a751cc25abd6a7ee8d0a8
  • SHA1 ab65006ca588f9780b97bb499b46a606e65feab0
  • SHA512 44398c308db545a741fafd5db2d76a536bb093f21f0b2db940203357758ccd0135b9ab975ce9bb81e6a99a681ee3fb539fa3a111ce716d512fa1c1c4e6e90412
  • SSDEEP 3072:2YKO7/QQX6/kZ6gqGYXDvwXTT5G9vNgSWTP+y6YByCs:6YBm
  • TLSH
    T145D4541B03221F915BB2908A53224F8BB768012D1C85C2A7F799F76DB8D79DD674F08B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2