Extracted

• • Target
    QUOTATION LIST_0398383_xls.JS.js
  • Size 3.3MB
  • SHA256 b8444cb7142e36826e8f6c23166079795a5e6bbb56a32bcd00ac061d37fdd1b0
  • MD5 16398359a93c29b68ad7a61aef9428fb
  • SHA1 d21d5f5f5e9a0d40d8f3a1b35958275c90111cdb
  • SHA512 f123d7c3ffdb5d2923db7936bf2e0a2aee4030261e6c4a86030fa1dc1e06bf388cf547561cd8b6888b2fbb0488a0d90e2e2a25f82f62022fd9901e32e999bb20
  • SSDEEP 98304:YXynY+6pn8aY7mv1eSc1kPs6spRhz7eQvE8Rph3+NbZbb8EwglcJS7ENt8BSscHw:YX+Yzpn8aY71k02Q2dbb8H5JS7ZSsMId
  • TLSH
    T10BF5928513C79532332FEB5C82369921990A500329C5DB39317CE31A767FE1BAF5CAE6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionxwormpersistenceratspywarestealertrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2