Extracted

• • Target
    NR-089087-0870-MQ0870-PO-09870=11-26.js
  • Size 147KB
  • SHA256 789db0dc883f1cc1ac9dca3fd1f43b32aeb062ce99bd92e0135e3d694585743a
  • MD5 fe7bdef4e6e09fd6f852d76464674d16
  • SHA1 675c53089015a64a31cfee4894c77536c9aaefd6
  • SHA512 fe0b823d165dc27a04d78b9bd431aa610103300f3e2c5e9c6b873f1943e0a4626fb5272ec756ef324f3535582d5277ac3da8cfa6a801b103114685404d67d4cf
  • SSDEEP 3072:55WjqHXwTi+BhCH8W16V+u7WmYTTG49JevYaCRE0STidkxA:55ITThCH8WYV+uixTGAegaCRE0KK
  • TLSH
    T1ECE3027A6DB1EC6B437DE72500AE4E1F77A52A016C42C85DB07ED1C6037AF70296BC88
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormpersistencerattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2