Extracted

Extracted

Extracted

Extracted

• • Target
    Statement of Account (SOA).xlx.js
  • Size 607KB
  • SHA256 4f53a3a7829566a809a4099715d85c4bda28fd4fc0e56daaa0e542678c55b878
  • MD5 6f87d2bdbc93956b766d2d3b6fccd969
  • SHA1 e4129069f384fa07d6167bd90fa17caeac675f9a
  • SHA512 0ca0142700934bfcfd79ee724c3ca0d1f13bf7e0c3c4feb1c2ecf36f302f9b84253d868525d759c49fcf1b8ceb7f2d749c3bf0a6e935fb18a569b2cb2924e2d3
  • SSDEEP 6144:7AHPKkMujVmdJAaR9BGISoIVRkGLOKbyqUinVknhQn5QO6:yGujVly9qvVftbyDiVknyn5QO6
  • TLSH
    T1DBD4122167FE5119F2F3AF54AEF865A68D7EBDA26E36D05C1150028E0972E80CDB0737
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remotehostexecutionremcosxwormpersistencerattrojan

  • Detect Xworm Payload

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Adds policy Run key to start application

    persistence

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • SmartAssembly .NET packer

    Detects SmartAssembly .NET packer.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2