Extracted

• • Target
    F12890.js
  • Size 715KB
  • SHA256 4d11737fffa17df49c0e51ca57725522c80e666121471f60eede1589b5e1be5a
  • MD5 bde6d4b3d143226cfa3cc33756983668
  • SHA1 26b94f74437e55d1e643447f659dd5f0461380f0
  • SHA512 6c7c61e084c5a03ecb3a2f0c5593213a52a26dd9eb8775d0f441bfd1954bd7c2da3be23f829b9e0f6c3ca9135bf91257150778c2e44a811fdd353d49ec0cba20
  • SSDEEP 1536:uBML8wxtEsmbWyknv6tW7PQFMnOTLMcSuLcTJRrLpVd4lq0EDe1n1+dSWg4FFMVM:swUeX
  • TLSH
    T1A3F4B2C7678C07EDAB988CDD454C3A5754F7C16A3C2E128DEDE14A17B43EE207A26A70
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2