Extracted

• • Target
    xDzmlkxwtW.js
  • Size 206KB
  • SHA256 2deccf4d047ace7faa8b5b304fc07e02500228cb067cdec6e7816727efde82ab
  • MD5 0b16e62ec5eb62e7ca0ce63674917bed
  • SHA1 bda880a4c46bc40a59fa764b785a77ee54f77f41
  • SHA512 3f4fa2f0fe001303001ae5664da49a604ed2196f803fb3f9b8299e1bbf55f49cfe035b2497ad47affebc30f21000430ff2d0ff34eb60058b20c25827c6aa6c75
  • SSDEEP 3072:ATgvzc2NfvlVnWGhFh63HVyuKuZW6NuLltHc9b8yu8DLjobuO:ATk9NW2FEV/PW6YL2RLob1
  • TLSH
    T12024F104B7913970035E4B6EC66EE94EC8AF6D208B58E6CCB935EAC15ECD7C78175C09
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  Executiondiscoveryexecutionxwormpersistencerattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Temporarily bypasses Powershell execution policy

    Using Set-ExecutionPolicy to permit execution of unsigned or restricted scripts in that process.

    Execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2