Extracted

• • Target
    Cotización insumos________________________________xls.js
  • Size 63KB
  • SHA256 15e7b3584444040943442856e071f61c6ac67a5004faea24436fe3a8f79083e8
  • MD5 00e09c0c63c346421a25e199e957083a
  • SHA1 c47b7d2afa2f83c00226732dd2886ebf326df303
  • SHA512 75359117389b7d2bd27d28b2370c467dc96e1cb09957aa3ba108ce304c34b57f9a0068a4664b66eedc86f51e7f1c742fb67293d86cf8db246e3b0f0b4f11b52f
  • SSDEEP 1536:JtmSXjMfSMJJRbg9p5poQPo6kimde3uvw8C8cTg/gnlKK7Y0T2:mSzMtCpXQRYnT/ds0T2
  • TLSH
    T19353E10394938C6F811E862C3BFB6D0582EE152D69CDC6493A5E9412AFC5EE01FBD4D7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasiondiscoveryexecutionxwormpyinstallerratspywarestealertrojanupx

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2