Extracted

• • Target

    E422635314-receipt.vbs

  • Size

    300.0MB

  • MD5

    7bce723cfb539c1e6679602ea324d401

  • SHA1

    814f0499c9d4458944b0c84f2aa8e4ce997a060e

  • SHA256

    aa50e96354a516d7c876c188293eba327bd78cc9e41ddab34767efaafed9f54f

  • SHA512

    24ca64a472b2ccec5bc7cdcfe476ba2168fa389a78ce8e3c030f33f23b6f7c2177adeef4d43a6c44eeee627754e1f9a5b161e9fce00ab13c3ce829ccf148241a

  • SSDEEP

    768:7xHiHb008VOraIRgKb0tkvb03q9ZmR4Z:diJq1OZ

  Score

  10^/10

  executionpersistencexwormzgratratspywarestealertrojan

  • Detect Xworm Payload

  • Detect ZGRat V1

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2