Extracted

• • Target
    Solicitud de cotización - Seiza.js
  • Size 202KB
  • SHA256 b9d5e9c5e18ca9ea2e7357e9af4943bbf1cdd861d74c2122e597997845ad2392
  • MD5 6285ae34cda31d387ecb491f402889fc
  • SHA1 462764ec71b34ef6fa1b264b0fbf322f612ab50e
  • SHA512 42747c280b12935bec7047836e5369ad1f1a309271349212292524123d087c5a1ad9bed1a8a1dd09d68bdeb0e3d2c47ae884d292dc2dcc185916d1c423e46615
  • SSDEEP 6144:hfs8dkyndfnK9yTbjDuRm9C5se9zCPS68AF:hfsqRndPKeDuoQ5se9zG8AF
  • TLSH
    T17814022533E0F6324BB59F28966FF98648946130C90CB8EC9595E8DBAF4D3D752F182C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  Executiondiscoveryexecutionxwormrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Temporarily bypasses Powershell execution policy

    Using Set-ExecutionPolicy to permit execution of unsigned or restricted scripts in that process.

    Execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2