Extracted

Extracted

• • Target

    softbankNDNCagreementPDF.vbs

  • Size

    198KB

  • MD5

    d4a13ff61d8f00b0e18d6d0add1c5796

  • SHA1

    681f3f3ec1537b3f1ae58921c8014cb7d23ce0c0

  • SHA256

    d76e889cf2575622ca27fcb43a4bfd4df2dba3cfdd3175c28abdef00d541eaa3

  • SHA512

    426511e9408474ce3923bad62e745b2a13bbe37a9f95d785ae3082afa163ecda02c14e6b2d6c8caae4a43bb8bed1386f4389a7fed32d3608d6386c3eec2d8537

  • SSDEEP

    3072:e1XQyor2jokDq30ojrDq3YoT2bok2uoQ2EonDUoupCo82oo31oPioM7cotcjOeMH:1

  Score

  10^/10

  xwormrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Blocklisted process makes network request

  • Drops startup file

  • Suspicious use of SetThreadContext

  behavioral1