Extracted

• • Target
    Transfer slip _Inv.no. 362098.JS.js
  • Size 2.3MB
  • SHA256 5aeaedc4f48b365ef84a005e3b00f8a904c2ec2ae9c6e8cf0c226402da479b4c
  • MD5 1385bbdd4e09a189ec25ea4b3e418e88
  • SHA1 93d5ac1b14091fa17bd5639d43a219f36d989fa0
  • SHA512 c7a6ec8e748a90d7e89a45356f4721479349518e034e82faa063061b74c70308570f7c2e8bd28816370a0e743edb01c70cd6a7b6835dfbc2140bc202fb5d269c
  • SSDEEP 49152:I8aoT1ggC1GAGN4KtjP8KZTE7lFE6zhrO3OJnwNIO63uMPFJQqhK33GRni:I8aoT1ggC1GAG6KtjP8SE73hhrsOJwNF
  • TLSH
    T12FB56F711384D133732D6B9F51FB99309A0A9C132D86CB3D35ADE618362CD5A6728BF2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasiondiscoveryexecutionxwormratspywarestealertrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2