Extracted

Extracted

• • Target
    SOLICITUD DE PRESUPUESTO - 109054456656.JS
  • Size 3.9MB
  • SHA256 1245b4d1aeefaa988eb300c0eb0fcbcbd1f5ddc80d5039ba79382839fffe36f4
  • MD5 e821118d9b197548d50ac7d39d20ae64
  • SHA1 d407525cf3120709ce242dc605a48e73121f7de6
  • SHA512 7674b6e1a8e12c3b86ea01d3675c20f1873683e668deae4d9dca32b3267bc338eadba2bdf92abc1c1fa3ca01bbfc8acee24906d1daacb9045a51ab936568e997
  • SSDEEP 98304:qNhuv6L5t42d2jDBvpeSaEOTceEeg/bOD8rm63sT0CVTCO0T25b9It9G0bpt1FZL:qNhuv6L5t4A2jDFpWEOTceEeg/bOD8rd
  • TLSH
    T1381687685A81523233A15F6F1925CB10D60D8D3339928F3A3AFDF194FB1EEC65B06693
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  costuradefense_evasiondiscoveryexecutiondarkcloudremcoswarzoneratxworminfostealerpackerpersistencepyinstallerratspywarestealertrojanupx

  • Detect Xworm Payload

  • Family: DarkCloud

    An information stealer written in Visual Basic.

    stealerdarkcloud

  • Family: Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Family: WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2