Extracted

• • Target
    PO300926.js
  • Size 33KB
  • SHA256 ca9d3d85b31f567b771cd886ea7f5ff7b67953d1fe3083241a3f3de554f9b5ca
  • MD5 a7d6eb86d48031b2d20dc9ac993f7fd9
  • SHA1 9ffc4d42d11bd8a5bc08d49ba873feec4775a6d6
  • SHA512 7bfce15affa9546348d2c0bd935dda150e1d18782087215ad4a0b1a538f5d65a3f0aada6d97c46137758a0e9652fd8fc4b58de0fb24f92b653bb9c7a8bdd39ba
  • SSDEEP 384:xqoDF5++eUNUjSDz+ZpPoOzdo0c/P/Ea0M88:xqo2XUNvopPooo0c/P/Ec88
  • TLSH
    T187F228E0F7620AB791FB776BAE59C34CC5429D1AD4F9B30CE863204F07BBD8A6502116
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormpersistencerattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2