Extracted

• • Target
    MB308992219AE.js
  • Size 200KB
  • SHA256 81f93dc173ad6b2d7592447c7910f70df668b1a06f7c2fcce08188a99d38dcb3
  • MD5 3058d8c2157d5fed07ae03c34c78db26
  • SHA1 75eda973461c85608ab8af55c2e003ab3c440589
  • SHA512 05c1698e9cfa411330c9eaede4bcc60236fd254f00d2a62da0483970e6c4dd1ffe782ae69efa2826991b9a5a11ccea1c9eb599290929c5f93860f2372456b2ea
  • SSDEEP 3072:/zeVO/gX3XuNvcikrfI1cUXeIuI5t8DPycRWk6YYTa5agZva7ka4j/xcw68:bE3akrfIbejI5tszA/YY4/xcw68
  • TLSH
    T163149EB861E0E41DEEE81CCA4C3817C1CBBED89ACC58E4916769D82596760FFC464B3D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  Executiondiscoveryexecutionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Temporarily bypasses Powershell execution policy

    Using Set-ExecutionPolicy to permit execution of unsigned or restricted scripts in that process.

    Execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2