Extracted

• • Target
    ALEGATO DE TUTELA_POR_INCUMPLIMIENTO.js
  • Size 60KB
  • SHA256 dd4b9767799491dd2512771297fbf54718946ec915622dd3c637b6359a9e2e5c
  • MD5 fd03c51da1ed5666ff2479a3b428ca35
  • SHA1 e86904d02f2f0ace2b5fd1459a8903f5c79eab52
  • SHA512 695f222efe0e526bb7d695872fb994135a6962e3fd32847826a6dce316bd449449937b9571334d462b8767817a410927ae82b7815ad106bc6f8b0988418141b6
  • SSDEEP 768:PS5EirIw35HjJ6GQHwJmiCVGyzjKgZnHX74QKMv0Zm0Ojon3sYepLzu4Z:PCEirIw35HjJ6GQHwJmiCVGyNDO36pN
  • TLSH
    T183538306C2C74D948E43629FC10AD91F9BB447E27C95A8956E36A3DEF7BCD2310B6630
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionxwormpersistencerattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2