Extracted

• • Target
    Прилив_83-11122401333_20260909.js
  • Size 214KB
  • SHA256 b72e09658cacf2b6e3f15e1982b48fb6bdb2b1480f91848dffea98d54ffd5309
  • MD5 c924c35667f97a6bf7960f5ae0246ec6
  • SHA1 b6bef5f143ee9103f6ae1bfcb71a7e2bbfb994a9
  • SHA512 68972ff0841d5acd79fca32b3ace816bfc9d42e01802d71fb421f0537b6640a9227c589d5ea43001d59deb4172d09a05d50926300c4452d4de9d97a4c81cfeed
  • SSDEEP 6144:COzKlehemXT88PvbM5gPSZeZ+cyaqLKBf2H:COGlO/QWzMCqZeZbqLKRa
  • TLSH
    T18124E16D5F8D6023AB2319BEC05EE60A08C537E0CBDDB6E48A9DC703E46CBCA457D945
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2